[gentoo-commits] linux-patches r2084 - genpatches-2.6/trunk/3.0

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2012-02-07 14:13:03 +0000 (Tue, 07 Feb 2012)
New Revision: 2084

Added:
   genpatches-2.6/trunk/3.0/1017_linux-3.0.18.patch
   genpatches-2.6/trunk/3.0/1018_linux-3.0.19.patch
   genpatches-2.6/trunk/3.0/1019_linux-3.0.20.patch
Log:
Add Linux patches 3.0.18, 3.0.19 and 3.0.20

Added: genpatches-2.6/trunk/3.0/1017_linux-3.0.18.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1017_linux-3.0.18.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1017_linux-3.0.18.patch	2012-02-07 14:13:03 UTC (rev 2084)
@@ -0,0 +1,3389 @@
+diff --git a/Makefile b/Makefile
+index 295fbda..581b8e9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 17
++SUBLEVEL = 18
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
+index 3be485a..f19de9f 100644
+--- a/arch/ia64/kernel/acpi.c
++++ b/arch/ia64/kernel/acpi.c
+@@ -429,22 +429,24 @@ static u32 __devinitdata pxm_flag[PXM_FLAG_LEN];
+ static struct acpi_table_slit __initdata *slit_table;
+ cpumask_t early_cpu_possible_map = CPU_MASK_NONE;
+ 
+-static int get_processor_proximity_domain(struct acpi_srat_cpu_affinity *pa)
++static int __init
++get_processor_proximity_domain(struct acpi_srat_cpu_affinity *pa)
+ {
+ 	int pxm;
+ 
+ 	pxm = pa->proximity_domain_lo;
+-	if (ia64_platform_is("sn2"))
++	if (ia64_platform_is("sn2") || acpi_srat_revision >= 2)
+ 		pxm += pa->proximity_domain_hi[0] << 8;
+ 	return pxm;
+ }
+ 
+-static int get_memory_proximity_domain(struct acpi_srat_mem_affinity *ma)
++static int __init
++get_memory_proximity_domain(struct acpi_srat_mem_affinity *ma)
+ {
+ 	int pxm;
+ 
+ 	pxm = ma->proximity_domain;
+-	if (!ia64_platform_is("sn2"))
++	if (!ia64_platform_is("sn2") && acpi_srat_revision <= 1)
+ 		pxm &= 0xff;
+ 
+ 	return pxm;
+diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
+index 577abba..83bb960 100644
+--- a/arch/score/kernel/entry.S
++++ b/arch/score/kernel/entry.S
+@@ -408,7 +408,7 @@ ENTRY(handle_sys)
+ 	sw	r9, [r0, PT_EPC]
+ 
+ 	cmpi.c	r27, __NR_syscalls 	# check syscall number
+-	bgtu	illegal_syscall
++	bgeu	illegal_syscall
+ 
+ 	slli	r8, r27, 2		# get syscall routine
+ 	la	r11, sys_call_table
+diff --git a/arch/x86/include/asm/amd_nb.h b/arch/x86/include/asm/amd_nb.h
+index 67f87f2..78a1eff 100644
+--- a/arch/x86/include/asm/amd_nb.h
++++ b/arch/x86/include/asm/amd_nb.h
+@@ -1,6 +1,7 @@
+ #ifndef _ASM_X86_AMD_NB_H
+ #define _ASM_X86_AMD_NB_H
+ 
++#include <linux/ioport.h>
+ #include <linux/pci.h>
+ 
+ struct amd_nb_bus_dev_range {
+@@ -13,6 +14,7 @@ extern const struct pci_device_id amd_nb_misc_ids[];
+ extern const struct amd_nb_bus_dev_range amd_nb_bus_dev_ranges[];
+ 
+ extern bool early_is_amd_nb(u32 value);
++extern struct resource *amd_get_mmconfig_range(struct resource *res);
+ extern int amd_cache_northbridges(void);
+ extern void amd_flush_garts(void);
+ extern int amd_numa_init(void);
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 4c39baa..bae1efe 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -119,6 +119,37 @@ bool __init early_is_amd_nb(u32 device)
+ 	return false;
+ }
+ 
++struct resource *amd_get_mmconfig_range(struct resource *res)
++{
++	u32 address;
++	u64 base, msr;
++	unsigned segn_busn_bits;
++
++	if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
++		return NULL;
++
++	/* assume all cpus from fam10h have mmconfig */
++        if (boot_cpu_data.x86 < 0x10)
++		return NULL;
++
++	address = MSR_FAM10H_MMIO_CONF_BASE;
++	rdmsrl(address, msr);
++
++	/* mmconfig is not enabled */
++	if (!(msr & FAM10H_MMIO_CONF_ENABLE))
++		return NULL;
++
++	base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
++
++	segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
++			 FAM10H_MMIO_CONF_BUSRANGE_MASK;
++
++	res->flags = IORESOURCE_MEM;
++	res->start = base;
++	res->end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
++	return res;
++}
++
+ int amd_get_subcaches(int cpu)
+ {
+ 	struct pci_dev *link = node_to_amd_nb(amd_get_nb_id(cpu))->link;
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index cfeb978..874c208 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -779,7 +779,12 @@ void __init uv_system_init(void)
+ 	for(i = 0; i < UVH_NODE_PRESENT_TABLE_DEPTH; i++)
+ 		uv_possible_blades +=
+ 		  hweight64(uv_read_local_mmr( UVH_NODE_PRESENT_TABLE + i * 8));
+-	printk(KERN_DEBUG "UV: Found %d blades\n", uv_num_possible_blades());
++
++	/* uv_num_possible_blades() is really the hub count */
++	printk(KERN_INFO "UV: Found %d blades, %d hubs\n",
++			is_uv1_hub() ? uv_num_possible_blades() :
++			(uv_num_possible_blades() + 1) / 2,
++			uv_num_possible_blades());
+ 
+ 	bytes = sizeof(struct uv_blade_info) * uv_num_possible_blades();
+ 	uv_blade_info = kzalloc(bytes, GFP_KERNEL);
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 1dab519..f927429 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -87,9 +87,9 @@ static unsigned long mmap_rnd(void)
+ 	*/
+ 	if (current->flags & PF_RANDOMIZE) {
+ 		if (mmap_is_ia32())
+-			rnd = (long)get_random_int() % (1<<8);
++			rnd = get_random_int() % (1<<8);
+ 		else
+-			rnd = (long)(get_random_int() % (1<<28));
++			rnd = get_random_int() % (1<<28);
+ 	}
+ 	return rnd << PAGE_SHIFT;
+ }
+diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
+index 81dbfde..7efd0c6 100644
+--- a/arch/x86/mm/srat.c
++++ b/arch/x86/mm/srat.c
+@@ -104,6 +104,8 @@ acpi_numa_processor_affinity_init(struct acpi_srat_cpu_affinity *pa)
+ 	if ((pa->flags & ACPI_SRAT_CPU_ENABLED) == 0)
+ 		return;
+ 	pxm = pa->proximity_domain_lo;
++	if (acpi_srat_revision >= 2)
++		pxm |= *((unsigned int*)pa->proximity_domain_hi) << 8;
+ 	node = setup_node(pxm);
+ 	if (node < 0) {
+ 		printk(KERN_ERR "SRAT: Too many proximity domains %x\n", pxm);
+@@ -155,6 +157,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
+ 	start = ma->base_address;
+ 	end = start + ma->length;
+ 	pxm = ma->proximity_domain;
++	if (acpi_srat_revision <= 1)
++		pxm &= 0xff;
+ 	node = setup_node(pxm);
+ 	if (node < 0) {
+ 		printk(KERN_ERR "SRAT: Too many proximity domains.\n");
+diff --git a/arch/x86/pci/Makefile b/arch/x86/pci/Makefile
+index 6b8759f..d24d3da 100644
+--- a/arch/x86/pci/Makefile
++++ b/arch/x86/pci/Makefile
+@@ -18,8 +18,9 @@ obj-$(CONFIG_X86_NUMAQ)		+= numaq_32.o
+ obj-$(CONFIG_X86_MRST)		+= mrst.o
+ 
+ obj-y				+= common.o early.o
+-obj-y				+= amd_bus.o bus_numa.o
++obj-y				+= bus_numa.o
+ 
++obj-$(CONFIG_AMD_NB)		+= amd_bus.o
+ obj-$(CONFIG_PCI_CNB20LE_QUIRK)	+= broadcom_bus.o
+ 
+ ifeq ($(CONFIG_PCI_DEBUG),y)
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index 50b3f14..53f9e68 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -149,7 +149,7 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
+ 	struct acpi_resource_address64 addr;
+ 	acpi_status status;
+ 	unsigned long flags;
+-	u64 start, end;
++	u64 start, orig_end, end;
+ 
+ 	status = resource_to_addr(acpi_res, &addr);
+ 	if (!ACPI_SUCCESS(status))
+@@ -165,7 +165,21 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
+ 		return AE_OK;
+ 
+ 	start = addr.minimum + addr.translation_offset;
+-	end = addr.maximum + addr.translation_offset;
++	orig_end = end = addr.maximum + addr.translation_offset;
++
++	/* Exclude non-addressable range or non-addressable portion of range */
++	end = min(end, (u64)iomem_resource.end);
++	if (end <= start) {
++		dev_info(&info->bridge->dev,
++			"host bridge window [%#llx-%#llx] "
++			"(ignored, not CPU addressable)\n", start, orig_end);
++		return AE_OK;
++	} else if (orig_end != end) {
++		dev_info(&info->bridge->dev,
++			"host bridge window [%#llx-%#llx] "
++			"([%#llx-%#llx] ignored, not CPU addressable)\n",
++			start, orig_end, end + 1, orig_end);
++	}
+ 
+ 	res = &info->res[info->res_num];
+ 	res->name = info->name;
+diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
+index 026e493..385a940 100644
+--- a/arch/x86/pci/amd_bus.c
++++ b/arch/x86/pci/amd_bus.c
+@@ -30,34 +30,6 @@ static struct pci_hostbridge_probe pci_probes[] __initdata = {
+ 	{ 0, 0x18, PCI_VENDOR_ID_AMD, 0x1300 },
+ };
+ 
+-static u64 __initdata fam10h_mmconf_start;
+-static u64 __initdata fam10h_mmconf_end;
+-static void __init get_pci_mmcfg_amd_fam10h_range(void)
+-{
+-	u32 address;
+-	u64 base, msr;
+-	unsigned segn_busn_bits;
+-
+-	/* assume all cpus from fam10h have mmconf */
+-        if (boot_cpu_data.x86 < 0x10)
+-		return;
+-
+-	address = MSR_FAM10H_MMIO_CONF_BASE;
+-	rdmsrl(address, msr);
+-
+-	/* mmconfig is not enable */
+-	if (!(msr & FAM10H_MMIO_CONF_ENABLE))
+-		return;
+-
+-	base = msr & (FAM10H_MMIO_CONF_BASE_MASK<<FAM10H_MMIO_CONF_BASE_SHIFT);
+-
+-	segn_busn_bits = (msr >> FAM10H_MMIO_CONF_BUSRANGE_SHIFT) &
+-			 FAM10H_MMIO_CONF_BUSRANGE_MASK;
+-
+-	fam10h_mmconf_start = base;
+-	fam10h_mmconf_end = base + (1ULL<<(segn_busn_bits + 20)) - 1;
+-}
+-
+ #define RANGE_NUM 16
+ 
+ /**
+@@ -85,6 +57,9 @@ static int __init early_fill_mp_bus_info(void)
+ 	u64 val;
+ 	u32 address;
+ 	bool found;
++	struct resource fam10h_mmconf_res, *fam10h_mmconf;
++	u64 fam10h_mmconf_start;
++	u64 fam10h_mmconf_end;
+ 
+ 	if (!early_pci_allowed())
+ 		return -1;
+@@ -211,12 +186,17 @@ static int __init early_fill_mp_bus_info(void)
+ 		subtract_range(range, RANGE_NUM, 0, end);
+ 
+ 	/* get mmconfig */
+-	get_pci_mmcfg_amd_fam10h_range();
++	fam10h_mmconf = amd_get_mmconfig_range(&fam10h_mmconf_res);
+ 	/* need to take out mmconf range */
+-	if (fam10h_mmconf_end) {
+-		printk(KERN_DEBUG "Fam 10h mmconf [%llx, %llx]\n", fam10h_mmconf_start, fam10h_mmconf_end);
++	if (fam10h_mmconf) {
++		printk(KERN_DEBUG "Fam 10h mmconf %pR\n", fam10h_mmconf);
++		fam10h_mmconf_start = fam10h_mmconf->start;
++		fam10h_mmconf_end = fam10h_mmconf->end;
+ 		subtract_range(range, RANGE_NUM, fam10h_mmconf_start,
+ 				 fam10h_mmconf_end + 1);
++	} else {
++		fam10h_mmconf_start = 0;
++		fam10h_mmconf_end = 0;
+ 	}
+ 
+ 	/* mmio resource */
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 82cff4a..edf435b 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -1575,14 +1575,14 @@ static int calculate_destination_timeout(void)
+ 		ts_ns = base * mult1 * mult2;
+ 		ret = ts_ns / 1000;
+ 	} else {
+-		/* 4 bits  0/1 for 10/80us, 3 bits of multiplier */
+-		mmr_image = uv_read_local_mmr(UVH_AGING_PRESCALE_SEL);
++		/* 4 bits  0/1 for 10/80us base, 3 bits of multiplier */
++		mmr_image = uv_read_local_mmr(UVH_LB_BAU_MISC_CONTROL);
+ 		mmr_image = (mmr_image & UV_SA_MASK) >> UV_SA_SHFT;
+ 		if (mmr_image & (1L << UV2_ACK_UNITS_SHFT))
+-			mult1 = 80;
++			base = 80;
+ 		else
+-			mult1 = 10;
+-		base = mmr_image & UV2_ACK_MASK;
++			base = 10;
++		mult1 = mmr_image & UV2_ACK_MASK;
+ 		ret = mult1 * base;
+ 	}
+ 	return ret;
+@@ -1820,6 +1820,8 @@ static int __init uv_bau_init(void)
+ 			uv_base_pnode = uv_blade_to_pnode(uvhub);
+ 	}
+ 
++	enable_timeouts();
++
+ 	if (init_per_cpu(nuvhubs, uv_base_pnode)) {
+ 		nobau = 1;
+ 		return 0;
+@@ -1830,7 +1832,6 @@ static int __init uv_bau_init(void)
+ 		if (uv_blade_nr_possible_cpus(uvhub))
+ 			init_uvhub(uvhub, vector, uv_base_pnode);
+ 
+-	enable_timeouts();
+ 	alloc_intr_gate(vector, uv_bau_message_intr1);
+ 
+ 	for_each_possible_blade(uvhub) {
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index 4f4230b..5ef1f4c 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -24,6 +24,7 @@
+ #include <linux/capability.h>
+ #include <linux/completion.h>
+ #include <linux/cdrom.h>
++#include <linux/ratelimit.h>
+ #include <linux/slab.h>
+ #include <linux/times.h>
+ #include <asm/uaccess.h>
+@@ -691,6 +692,57 @@ int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mod
+ }
+ EXPORT_SYMBOL(scsi_cmd_ioctl);
+ 
++int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
++{
++	if (bd && bd == bd->bd_contains)
++		return 0;
++
++	/* Actually none of these is particularly useful on a partition,
++	 * but they are safe.
++	 */
++	switch (cmd) {
++	case SCSI_IOCTL_GET_IDLUN:
++	case SCSI_IOCTL_GET_BUS_NUMBER:
++	case SCSI_IOCTL_GET_PCI:
++	case SCSI_IOCTL_PROBE_HOST:
++	case SG_GET_VERSION_NUM:
++	case SG_SET_TIMEOUT:
++	case SG_GET_TIMEOUT:
++	case SG_GET_RESERVED_SIZE:
++	case SG_SET_RESERVED_SIZE:
++	case SG_EMULATED_HOST:
++		return 0;
++	case CDROM_GET_CAPABILITY:
++		/* Keep this until we remove the printk below.  udev sends it
++		 * and we do not want to spam dmesg about it.   CD-ROMs do
++		 * not have partitions, so we get here only for disks.
++		 */
++		return -ENOTTY;
++	default:
++		break;
++	}
++
++	/* In particular, rule out all resets and host-specific ioctls.  */
++	printk_ratelimited(KERN_WARNING
++			   "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
++
++	return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
++}
++EXPORT_SYMBOL(scsi_verify_blk_ioctl);
++
++int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
++		       unsigned int cmd, void __user *arg)
++{
++	int ret;
++
++	ret = scsi_verify_blk_ioctl(bd, cmd);
++	if (ret < 0)
++		return ret;
++
++	return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
++}
++EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
++
+ static int __init blk_scsi_ioctl_init(void)
+ {
+ 	blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
+diff --git a/drivers/acpi/acpica/dsargs.c b/drivers/acpi/acpica/dsargs.c
+index 8c7b997..42163d8 100644
+--- a/drivers/acpi/acpica/dsargs.c
++++ b/drivers/acpi/acpica/dsargs.c
+@@ -387,5 +387,29 @@ acpi_status acpi_ds_get_region_arguments(union acpi_operand_object *obj_desc)
+ 	status = acpi_ds_execute_arguments(node, node->parent,
+ 					   extra_desc->extra.aml_length,
+ 					   extra_desc->extra.aml_start);
++	if (ACPI_FAILURE(status)) {
++		return_ACPI_STATUS(status);
++	}
++
++	/* Validate the region address/length via the host OS */
++
++	status = acpi_os_validate_address(obj_desc->region.space_id,
++					  obj_desc->region.address,
++					  (acpi_size) obj_desc->region.length,
++					  acpi_ut_get_node_name(node));
++
++	if (ACPI_FAILURE(status)) {
++		/*
++		 * Invalid address/length. We will emit an error message and mark
++		 * the region as invalid, so that it will cause an additional error if
++		 * it is ever used. Then return AE_OK.
++		 */
++		ACPI_EXCEPTION((AE_INFO, status,
++				"During address validation of OpRegion [%4.4s]",
++				node->name.ascii));
++		obj_desc->common.flags |= AOPOBJ_INVALID;
++		status = AE_OK;
++	}
++
+ 	return_ACPI_STATUS(status);
+ }
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 3b5c318..e56f3be 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -45,6 +45,8 @@ static int pxm_to_node_map[MAX_PXM_DOMAINS]
+ static int node_to_pxm_map[MAX_NUMNODES]
+ 			= { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
+ 
++unsigned char acpi_srat_revision __initdata;
++
+ int pxm_to_node(int pxm)
+ {
+ 	if (pxm < 0)
+@@ -255,9 +257,13 @@ acpi_parse_memory_affinity(struct acpi_subtable_header * header,
+ 
+ static int __init acpi_parse_srat(struct acpi_table_header *table)
+ {
++	struct acpi_table_srat *srat;
+ 	if (!table)
+ 		return -EINVAL;
+ 
++	srat = (struct acpi_table_srat *)table;
++	acpi_srat_revision = srat->header.revision;
++
+ 	/* Real work done in acpi_table_parse_srat below. */
+ 
+ 	return 0;
+diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
+index 02d2a4c..0c0669f 100644
+--- a/drivers/acpi/processor_core.c
++++ b/drivers/acpi/processor_core.c
+@@ -172,8 +172,30 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
+ 	apic_id = map_mat_entry(handle, type, acpi_id);
+ 	if (apic_id == -1)
+ 		apic_id = map_madt_entry(type, acpi_id);
+-	if (apic_id == -1)
+-		return apic_id;
++	if (apic_id == -1) {
++		/*
++		 * On UP processor, there is no _MAT or MADT table.
++		 * So above apic_id is always set to -1.
++		 *
++		 * BIOS may define multiple CPU handles even for UP processor.
++		 * For example,
++		 *
++		 * Scope (_PR)
++                 * {
++		 *     Processor (CPU0, 0x00, 0x00000410, 0x06) {}
++		 *     Processor (CPU1, 0x01, 0x00000410, 0x06) {}
++		 *     Processor (CPU2, 0x02, 0x00000410, 0x06) {}
++		 *     Processor (CPU3, 0x03, 0x00000410, 0x06) {}
++		 * }
++		 *
++		 * Ignores apic_id and always return 0 for CPU0's handle.
++		 * Return -1 for other CPU's handle.
++		 */
++		if (acpi_id == 0)
++			return acpi_id;
++		else
++			return apic_id;
++	}
+ 
+ #ifdef CONFIG_SMP
+ 	for_each_possible_cpu(i) {
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index c2f9b3e..1dab802 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -1716,7 +1716,7 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
+ 	case CCISS_BIG_PASSTHRU:
+ 		return cciss_bigpassthru(h, argp);
+ 
+-	/* scsi_cmd_ioctl handles these, below, though some are not */
++	/* scsi_cmd_blk_ioctl handles these, below, though some are not */
+ 	/* very meaningful for cciss.  SG_IO is the main one people want. */
+ 
+ 	case SG_GET_VERSION_NUM:
+@@ -1727,9 +1727,9 @@ static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
+ 	case SG_EMULATED_HOST:
+ 	case SG_IO:
+ 	case SCSI_IOCTL_SEND_COMMAND:
+-		return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
++		return scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+ 
+-	/* scsi_cmd_ioctl would normally handle these, below, but */
++	/* scsi_cmd_blk_ioctl would normally handle these, below, but */
+ 	/* they aren't a good fit for cciss, as CD-ROMs are */
+ 	/* not supported, and we don't have any bus/target/lun */
+ 	/* which we present to the kernel. */
+diff --git a/drivers/block/ub.c b/drivers/block/ub.c
+index 0e376d4..7333b9e 100644
+--- a/drivers/block/ub.c
++++ b/drivers/block/ub.c
+@@ -1744,12 +1744,11 @@ static int ub_bd_release(struct gendisk *disk, fmode_t mode)
+ static int ub_bd_ioctl(struct block_device *bdev, fmode_t mode,
+     unsigned int cmd, unsigned long arg)
+ {
+-	struct gendisk *disk = bdev->bd_disk;
+ 	void __user *usermem = (void __user *) arg;
+ 	int ret;
+ 
+ 	mutex_lock(&ub_mutex);
+-	ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, usermem);
++	ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, usermem);
+ 	mutex_unlock(&ub_mutex);
+ 
+ 	return ret;
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 079c088..5d7a934 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -236,8 +236,8 @@ static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
+ 	if (!virtio_has_feature(vblk->vdev, VIRTIO_BLK_F_SCSI))
+ 		return -ENOTTY;
+ 
+-	return scsi_cmd_ioctl(disk->queue, disk, mode, cmd,
+-			      (void __user *)data);
++	return scsi_cmd_blk_ioctl(bdev, mode, cmd,
++				  (void __user *)data);
+ }
+ 
+ /* We provide getgeo only to please some old bootloader/partitioning tools */
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 75fb965..b693cbd 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2741,12 +2741,11 @@ int cdrom_ioctl(struct cdrom_device_info *cdi, struct block_device *bdev,
+ {
+ 	void __user *argp = (void __user *)arg;
+ 	int ret;
+-	struct gendisk *disk = bdev->bd_disk;
+ 
+ 	/*
+ 	 * Try the generic SCSI command ioctl's first.
+ 	 */
+-	ret = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
++	ret = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+ 	if (ret != -ENOTTY)
+ 		return ret;
+ 
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index b94d871..7642495 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2069,6 +2069,7 @@ bool r100_gpu_is_lockup(struct radeon_device *rdev)
+ void r100_bm_disable(struct radeon_device *rdev)
+ {
+ 	u32 tmp;
++	u16 tmp16;
+ 
+ 	/* disable bus mastering */
+ 	tmp = RREG32(R_000030_BUS_CNTL);
+@@ -2079,8 +2080,8 @@ void r100_bm_disable(struct radeon_device *rdev)
+ 	WREG32(R_000030_BUS_CNTL, (tmp & 0xFFFFFFFF) | 0x00000040);
+ 	tmp = RREG32(RADEON_BUS_CNTL);
+ 	mdelay(1);
+-	pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
+-	pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
++	pci_read_config_word(rdev->pdev, 0x4, &tmp16);
++	pci_write_config_word(rdev->pdev, 0x4, tmp16 & 0xFFFB);
+ 	mdelay(1);
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
+index f5ac7e7..c45d921 100644
+--- a/drivers/gpu/drm/radeon/r600_hdmi.c
++++ b/drivers/gpu/drm/radeon/r600_hdmi.c
+@@ -196,6 +196,13 @@ static void r600_hdmi_videoinfoframe(
+ 	frame[0xD] = (right_bar >> 8);
+ 
+ 	r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
++	/* Our header values (type, version, length) should be alright, Intel
++	 * is using the same. Checksum function also seems to be OK, it works
++	 * fine for audio infoframe. However calculated value is always lower
++	 * by 2 in comparison to fglrx. It breaks displaying anything in case
++	 * of TVs that strictly check the checksum. Hack it manually here to
++	 * workaround this issue. */
++	frame[0x0] += 2;
+ 
+ 	WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+ 		frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
+index 440e6ec..5d0c123 100644
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -223,8 +223,11 @@ int radeon_wb_init(struct radeon_device *rdev)
+ 	if (radeon_no_wb == 1)
+ 		rdev->wb.enabled = false;
+ 	else {
+-		/* often unreliable on AGP */
+ 		if (rdev->flags & RADEON_IS_AGP) {
++			/* often unreliable on AGP */
++			rdev->wb.enabled = false;
++		} else if (rdev->family < CHIP_R300) {
++			/* often unreliable on pre-r300 */
+ 			rdev->wb.enabled = false;
+ 		} else {
+ 			rdev->wb.enabled = true;
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index a37a1ef..21acfb5 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -324,10 +324,10 @@ void rs600_hpd_fini(struct radeon_device *rdev)
+ 
+ void rs600_bm_disable(struct radeon_device *rdev)
+ {
+-	u32 tmp;
++	u16 tmp;
+ 
+ 	/* disable bus mastering */
+-	pci_read_config_word(rdev->pdev, 0x4, (u16*)&tmp);
++	pci_read_config_word(rdev->pdev, 0x4, &tmp);
+ 	pci_write_config_word(rdev->pdev, 0x4, tmp & 0xFFFB);
+ 	mdelay(1);
+ }
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 763797d..2f855b1 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -361,7 +361,7 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
+ 
+ 	case HID_GLOBAL_ITEM_TAG_REPORT_SIZE:
+ 		parser->global.report_size = item_udata(item);
+-		if (parser->global.report_size > 32) {
++		if (parser->global.report_size > 96) {
+ 			dbg_hid("invalid report_size %d\n",
+ 					parser->global.report_size);
+ 			return -1;
+@@ -1382,11 +1382,13 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_TRUETOUCH) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2515) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_EMS, USB_DEVICE_ID_EMS_TRIO_LINKER_PLUS_II) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 206f750..e0a28ad 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -21,6 +21,7 @@
+ #define USB_VENDOR_ID_3M		0x0596
+ #define USB_DEVICE_ID_3M1968		0x0500
+ #define USB_DEVICE_ID_3M2256		0x0502
++#define USB_DEVICE_ID_3M3266		0x0506
+ 
+ #define USB_VENDOR_ID_A4TECH		0x09da
+ #define USB_DEVICE_ID_A4TECH_WCP32PU	0x0006
+@@ -230,11 +231,14 @@
+ 
+ #define USB_VENDOR_ID_DWAV		0x0eef
+ #define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER	0x0001
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH	0x480d
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1	0x720c
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2	0x72a1
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3	0x480e
+-#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4	0x726b
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D	0x480d
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E	0x480e
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C	0x720c
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B	0x726b
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1	0x72a1
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA	0x72fa
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302	0x7302
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001	0xa001
+ 
+ #define USB_VENDOR_ID_ELECOM		0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084	0x0061
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 685d8e4..1308703 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -593,6 +593,9 @@ static const struct hid_device_id mt_devices[] = {
+ 	{ .driver_data = MT_CLS_3M,
+ 		HID_USB_DEVICE(USB_VENDOR_ID_3M,
+ 			USB_DEVICE_ID_3M2256) },
++	{ .driver_data = MT_CLS_3M,
++		HID_USB_DEVICE(USB_VENDOR_ID_3M,
++			USB_DEVICE_ID_3M3266) },
+ 
+ 	/* ActionStar panels */
+ 	{ .driver_data = MT_CLS_DEFAULT,
+@@ -629,23 +632,32 @@ static const struct hid_device_id mt_devices[] = {
+ 			USB_DEVICE_ID_CYPRESS_TRUETOUCH) },
+ 
+ 	/* eGalax devices (resistive) */
+-	{  .driver_data = MT_CLS_EGALAX,
++	{ .driver_data = MT_CLS_EGALAX,
+ 		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+-			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH) },
+-	{  .driver_data = MT_CLS_EGALAX,
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480D) },
++	{ .driver_data = MT_CLS_EGALAX,
+ 		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+-			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH3) },
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_480E) },
+ 
+ 	/* eGalax devices (capacitive) */
+-	{  .driver_data = MT_CLS_EGALAX,
++	{ .driver_data = MT_CLS_EGALAX,
++		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_720C) },
++	{ .driver_data = MT_CLS_EGALAX,
++		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_726B) },
++	{ .driver_data = MT_CLS_EGALAX,
++		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72A1) },
++	{ .driver_data = MT_CLS_EGALAX,
+ 		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+-			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH1) },
+-	{  .driver_data = MT_CLS_EGALAX,
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_72FA) },
++	{ .driver_data = MT_CLS_EGALAX,
+ 		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+-			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH2) },
+-	{  .driver_data = MT_CLS_EGALAX,
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7302) },
++	{ .driver_data = MT_CLS_EGALAX,
+ 		HID_USB_DEVICE(USB_VENDOR_ID_DWAV,
+-			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH4) },
++			USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
+ 
+ 	/* Elo TouchSystems IntelliTouch Plus panel */
+ 	{ .driver_data = MT_CLS_DUAL_NSMU_CONTACTID,
+diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
+index dd36417..cd7ac5c 100644
+--- a/drivers/i2c/busses/i2c-ali1535.c
++++ b/drivers/i2c/busses/i2c-ali1535.c
+@@ -140,7 +140,7 @@ static unsigned short ali1535_smba;
+    defined to make the transition easier. */
+ static int __devinit ali1535_setup(struct pci_dev *dev)
+ {
+-	int retval = -ENODEV;
++	int retval;
+ 	unsigned char temp;
+ 
+ 	/* Check the following things:
+@@ -155,6 +155,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ 	if (ali1535_smba == 0) {
+ 		dev_warn(&dev->dev,
+ 			"ALI1535_smb region uninitialized - upgrade BIOS?\n");
++		retval = -ENODEV;
+ 		goto exit;
+ 	}
+ 
+@@ -167,6 +168,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ 			    ali1535_driver.name)) {
+ 		dev_err(&dev->dev, "ALI1535_smb region 0x%x already in use!\n",
+ 			ali1535_smba);
++		retval = -EBUSY;
+ 		goto exit;
+ 	}
+ 
+@@ -174,6 +176,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ 	pci_read_config_byte(dev, SMBCFG, &temp);
+ 	if ((temp & ALI1535_SMBIO_EN) == 0) {
+ 		dev_err(&dev->dev, "SMB device not enabled - upgrade BIOS?\n");
++		retval = -ENODEV;
+ 		goto exit_free;
+ 	}
+ 
+@@ -181,6 +184,7 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ 	pci_read_config_byte(dev, SMBHSTCFG, &temp);
+ 	if ((temp & 1) == 0) {
+ 		dev_err(&dev->dev, "SMBus controller not enabled - upgrade BIOS?\n");
++		retval = -ENODEV;
+ 		goto exit_free;
+ 	}
+ 
+@@ -198,12 +202,11 @@ static int __devinit ali1535_setup(struct pci_dev *dev)
+ 	dev_dbg(&dev->dev, "SMBREV = 0x%X\n", temp);
+ 	dev_dbg(&dev->dev, "ALI1535_smba = 0x%X\n", ali1535_smba);
+ 
+-	retval = 0;
+-exit:
+-	return retval;
++	return 0;
+ 
+ exit_free:
+ 	release_region(ali1535_smba, ALI1535_SMB_IOSIZE);
++exit:
+ 	return retval;
+ }
+ 
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 8abfa4a..656b028 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
++++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -242,7 +242,7 @@ static void pch_i2c_init(struct i2c_algo_pch_data *adap)
+ 	if (pch_clk > PCH_MAX_CLK)
+ 		pch_clk = 62500;
+ 
+-	pch_i2cbc = (pch_clk + (pch_i2c_speed * 4)) / pch_i2c_speed * 8;
++	pch_i2cbc = (pch_clk + (pch_i2c_speed * 4)) / (pch_i2c_speed * 8);
+ 	/* Set transfer speed in I2CBC */
+ 	iowrite32(pch_i2cbc, p + PCH_I2CBC);
+ 
+diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
+index ff1e127..4853b52 100644
+--- a/drivers/i2c/busses/i2c-nforce2.c
++++ b/drivers/i2c/busses/i2c-nforce2.c
+@@ -356,7 +356,7 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
+ 	error = acpi_check_region(smbus->base, smbus->size,
+ 				  nforce2_driver.name);
+ 	if (error)
+-		return -1;
++		return error;
+ 
+ 	if (!request_region(smbus->base, smbus->size, nforce2_driver.name)) {
+ 		dev_err(&smbus->adapter.dev, "Error requesting region %02x .. %02X for %s\n",
+diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
+index 58a58c7..137e1a3 100644
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -235,7 +235,7 @@ const static u8 omap4_reg_map[] = {
+ 	[OMAP_I2C_BUF_REG] = 0x94,
+ 	[OMAP_I2C_CNT_REG] = 0x98,
+ 	[OMAP_I2C_DATA_REG] = 0x9c,
+-	[OMAP_I2C_SYSC_REG] = 0x20,
++	[OMAP_I2C_SYSC_REG] = 0x10,
+ 	[OMAP_I2C_CON_REG] = 0xa4,
+ 	[OMAP_I2C_OA_REG] = 0xa8,
+ 	[OMAP_I2C_SA_REG] = 0xac,
+diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
+index 4375866..6d60284 100644
+--- a/drivers/i2c/busses/i2c-sis5595.c
++++ b/drivers/i2c/busses/i2c-sis5595.c
+@@ -147,7 +147,7 @@ static int __devinit sis5595_setup(struct pci_dev *SIS5595_dev)
+ 	u16 a;
+ 	u8 val;
+ 	int *i;
+-	int retval = -ENODEV;
++	int retval;
+ 
+ 	/* Look for imposters */
+ 	for (i = blacklist; *i != 0; i++) {
+@@ -223,7 +223,7 @@ static int __devinit sis5595_setup(struct pci_dev *SIS5595_dev)
+ 
+ error:
+ 	release_region(sis5595_base + SMB_INDEX, 2);
+-	return retval;
++	return -ENODEV;
+ }
+ 
+ static int sis5595_transaction(struct i2c_adapter *adap)
+diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
+index e6f539e..b617fd0 100644
+--- a/drivers/i2c/busses/i2c-sis630.c
++++ b/drivers/i2c/busses/i2c-sis630.c
+@@ -393,7 +393,7 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ {
+ 	unsigned char b;
+ 	struct pci_dev *dummy = NULL;
+-	int retval = -ENODEV, i;
++	int retval, i;
+ 
+ 	/* check for supported SiS devices */
+ 	for (i=0; supported[i] > 0 ; i++) {
+@@ -418,18 +418,21 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ 	*/
+ 	if (pci_read_config_byte(sis630_dev, SIS630_BIOS_CTL_REG,&b)) {
+ 		dev_err(&sis630_dev->dev, "Error: Can't read bios ctl reg\n");
++		retval = -ENODEV;
+ 		goto exit;
+ 	}
+ 	/* if ACPI already enabled , do nothing */
+ 	if (!(b & 0x80) &&
+ 	    pci_write_config_byte(sis630_dev, SIS630_BIOS_CTL_REG, b | 0x80)) {
+ 		dev_err(&sis630_dev->dev, "Error: Can't enable ACPI\n");
++		retval = -ENODEV;
+ 		goto exit;
+ 	}
+ 
+ 	/* Determine the ACPI base address */
+ 	if (pci_read_config_word(sis630_dev,SIS630_ACPI_BASE_REG,&acpi_base)) {
+ 		dev_err(&sis630_dev->dev, "Error: Can't determine ACPI base address\n");
++		retval = -ENODEV;
+ 		goto exit;
+ 	}
+ 
+@@ -445,6 +448,7 @@ static int __devinit sis630_setup(struct pci_dev *sis630_dev)
+ 			    sis630_driver.name)) {
+ 		dev_err(&sis630_dev->dev, "SMBus registers 0x%04x-0x%04x already "
+ 			"in use!\n", acpi_base + SMB_STS, acpi_base + SMB_SAA);
++		retval = -EBUSY;
+ 		goto exit;
+ 	}
+ 
+diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
+index 0b012f1..58261d4 100644
+--- a/drivers/i2c/busses/i2c-viapro.c
++++ b/drivers/i2c/busses/i2c-viapro.c
+@@ -324,7 +324,7 @@ static int __devinit vt596_probe(struct pci_dev *pdev,
+ 				 const struct pci_device_id *id)
+ {
+ 	unsigned char temp;
+-	int error = -ENODEV;
++	int error;
+ 
+ 	/* Determine the address of the SMBus areas */
+ 	if (force_addr) {
+@@ -390,6 +390,7 @@ found:
+ 			dev_err(&pdev->dev, "SMBUS: Error: Host SMBus "
+ 				"controller not enabled! - upgrade BIOS or "
+ 				"use force=1\n");
++			error = -ENODEV;
+ 			goto release_region;
+ 		}
+ 	}
+@@ -422,9 +423,11 @@ found:
+ 		 "SMBus Via Pro adapter at %04x", vt596_smba);
+ 
+ 	vt596_pdev = pci_dev_get(pdev);
+-	if (i2c_add_adapter(&vt596_adapter)) {
++	error = i2c_add_adapter(&vt596_adapter);
++	if (error) {
+ 		pci_dev_put(vt596_pdev);
+ 		vt596_pdev = NULL;
++		goto release_region;
+ 	}
+ 
+ 	/* Always return failure here.  This is to allow other drivers to bind
+diff --git a/drivers/ide/ide-floppy_ioctl.c b/drivers/ide/ide-floppy_ioctl.c
+index d267b7a..a22ca84 100644
+--- a/drivers/ide/ide-floppy_ioctl.c
++++ b/drivers/ide/ide-floppy_ioctl.c
+@@ -292,8 +292,7 @@ int ide_floppy_ioctl(ide_drive_t *drive, struct block_device *bdev,
+ 	 * and CDROM_SEND_PACKET (legacy) ioctls
+ 	 */
+ 	if (cmd != CDROM_SEND_PACKET && cmd != SCSI_IOCTL_SEND_COMMAND)
+-		err = scsi_cmd_ioctl(bdev->bd_disk->queue, bdev->bd_disk,
+-				mode, cmd, argp);
++		err = scsi_cmd_blk_ioctl(bdev, mode, cmd, argp);
+ 
+ 	if (err == -ENOTTY)
+ 		err = generic_ide_ioctl(drive, bdev, cmd, arg);
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index a46dddf..026f9aa 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -321,7 +321,8 @@ static int intel_idle_probe(void)
+ 	cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &mwait_substates);
+ 
+ 	if (!(ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED) ||
+-		!(ecx & CPUID5_ECX_INTERRUPT_BREAK))
++	    !(ecx & CPUID5_ECX_INTERRUPT_BREAK) ||
++	    !mwait_substates)
+ 			return -ENODEV;
+ 
+ 	pr_debug(PREFIX "MWAIT substates: 0x%x\n", mwait_substates);
+@@ -367,7 +368,7 @@ static int intel_idle_probe(void)
+ 	if (boot_cpu_has(X86_FEATURE_ARAT))	/* Always Reliable APIC Timer */
+ 		lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
+ 	else {
+-		smp_call_function(__setup_broadcast_timer, (void *)true, 1);
++		on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
+ 		register_cpu_notifier(&setup_broadcast_notifier);
+ 	}
+ 
+@@ -459,7 +460,7 @@ static int intel_idle_cpuidle_devices_init(void)
+ 		}
+ 	}
+ 	if (auto_demotion_disable_flags)
+-		smp_call_function(auto_demotion_disable, NULL, 1);
++		on_each_cpu(auto_demotion_disable, NULL, 1);
+ 
+ 	return 0;
+ }
+@@ -499,7 +500,7 @@ static void __exit intel_idle_exit(void)
+ 	cpuidle_unregister_driver(&intel_idle_driver);
+ 
+ 	if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) {
+-		smp_call_function(__setup_broadcast_timer, (void *)false, 1);
++		on_each_cpu(__setup_broadcast_timer, (void *)false, 1);
+ 		unregister_cpu_notifier(&setup_broadcast_notifier);
+ 	}
+ 
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index ea79062..3e90b80 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -149,8 +149,17 @@ static int flakey_status(struct dm_target *ti, status_type_t type,
+ static int flakey_ioctl(struct dm_target *ti, unsigned int cmd, unsigned long arg)
+ {
+ 	struct flakey_c *fc = ti->private;
++	struct dm_dev *dev = fc->dev;
++	int r = 0;
+ 
+-	return __blkdev_driver_ioctl(fc->dev->bdev, fc->dev->mode, cmd, arg);
++	/*
++	 * Only pass ioctls through if the device sizes match exactly.
++	 */
++	if (fc->start ||
++	    ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
++		r = scsi_verify_blk_ioctl(NULL, cmd);
++
++	return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
+ }
+ 
+ static int flakey_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+diff --git a/drivers/md/dm-linear.c b/drivers/md/dm-linear.c
+index 3921e3b..9728839 100644
+--- a/drivers/md/dm-linear.c
++++ b/drivers/md/dm-linear.c
+@@ -116,7 +116,17 @@ static int linear_ioctl(struct dm_target *ti, unsigned int cmd,
+ 			unsigned long arg)
+ {
+ 	struct linear_c *lc = (struct linear_c *) ti->private;
+-	return __blkdev_driver_ioctl(lc->dev->bdev, lc->dev->mode, cmd, arg);
++	struct dm_dev *dev = lc->dev;
++	int r = 0;
++
++	/*
++	 * Only pass ioctls through if the device sizes match exactly.
++	 */
++	if (lc->start ||
++	    ti->len != i_size_read(dev->bdev->bd_inode) >> SECTOR_SHIFT)
++		r = scsi_verify_blk_ioctl(NULL, cmd);
++
++	return r ? : __blkdev_driver_ioctl(dev->bdev, dev->mode, cmd, arg);
+ }
+ 
+ static int linear_merge(struct dm_target *ti, struct bvec_merge_data *bvm,
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 209991b..70373bf 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1584,6 +1584,12 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
+ 
+ 	spin_unlock_irqrestore(&m->lock, flags);
+ 
++	/*
++	 * Only pass ioctls through if the device sizes match exactly.
++	 */
++	if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
++		r = scsi_verify_blk_ioctl(NULL, cmd);
++
+ 	return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+ }
+ 
+diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
+index 543a803..dbefdb0 100644
+--- a/drivers/media/video/uvc/uvc_v4l2.c
++++ b/drivers/media/video/uvc/uvc_v4l2.c
+@@ -65,6 +65,15 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
+ 			goto done;
+ 		}
+ 
++		/* Prevent excessive memory consumption, as well as integer
++		 * overflows.
++		 */
++		if (xmap->menu_count == 0 ||
++		    xmap->menu_count > UVC_MAX_CONTROL_MENU_ENTRIES) {
++			ret = -EINVAL;
++			goto done;
++		}
++
+ 		size = xmap->menu_count * sizeof(*map->menu_info);
+ 		map->menu_info = kmalloc(size, GFP_KERNEL);
+ 		if (map->menu_info == NULL) {
+diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
+index 2a38d5e..cf2401a 100644
+--- a/drivers/media/video/uvc/uvcvideo.h
++++ b/drivers/media/video/uvc/uvcvideo.h
+@@ -200,6 +200,7 @@ struct uvc_xu_control {
+ 
+ /* Maximum allowed number of control mappings per device */
+ #define UVC_MAX_CONTROL_MAPPINGS	1024
++#define UVC_MAX_CONTROL_MENU_ENTRIES	32
+ 
+ /* Devices quirks */
+ #define UVC_QUIRK_STATUS_INTERVAL	0x00000001
+diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
+index 69e8c6f..bda252f 100644
+--- a/drivers/media/video/v4l2-ioctl.c
++++ b/drivers/media/video/v4l2-ioctl.c
+@@ -2289,6 +2289,10 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
+ 		struct v4l2_ext_controls *ctrls = parg;
+ 
+ 		if (ctrls->count != 0) {
++			if (ctrls->count > V4L2_CID_MAX_CTRLS) {
++				ret = -EINVAL;
++				break;
++			}
+ 			*user_ptr = (void __user *)ctrls->controls;
+ 			*kernel_ptr = (void **)&ctrls->controls;
+ 			*array_size = sizeof(struct v4l2_ext_control)
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 20b42c8..f601180 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -830,7 +830,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ 			 *
+ 			 * WARNING: eMMC rules are NOT the same as SD DDR
+ 			 */
+-			if (ddr == EXT_CSD_CARD_TYPE_DDR_1_2V) {
++			if (ddr == MMC_1_2V_DDR_MODE) {
+ 				err = mmc_set_signal_voltage(host,
+ 					MMC_SIGNAL_VOLTAGE_120, 0);
+ 				if (err)
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 6d3de08..153008f 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1340,8 +1340,7 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ 		if ((ios->timing == MMC_TIMING_UHS_SDR50) ||
+ 		    (ios->timing == MMC_TIMING_UHS_SDR104) ||
+ 		    (ios->timing == MMC_TIMING_UHS_DDR50) ||
+-		    (ios->timing == MMC_TIMING_UHS_SDR25) ||
+-		    (ios->timing == MMC_TIMING_UHS_SDR12))
++		    (ios->timing == MMC_TIMING_UHS_SDR25))
+ 			ctrl |= SDHCI_CTRL_HISPD;
+ 
+ 		ctrl_2 = sdhci_readw(host, SDHCI_HOST_CONTROL2);
+@@ -2227,9 +2226,8 @@ int sdhci_suspend_host(struct sdhci_host *host, pm_message_t state)
+ 	/* Disable tuning since we are suspending */
+ 	if (host->version >= SDHCI_SPEC_300 && host->tuning_count &&
+ 	    host->tuning_mode == SDHCI_TUNING_MODE_1) {
++		del_timer_sync(&host->tuning_timer);
+ 		host->flags &= ~SDHCI_NEEDS_RETUNING;
+-		mod_timer(&host->tuning_timer, jiffies +
+-			host->tuning_count * HZ);
+ 	}
+ 
+ 	ret = mmc_suspend_host(host->mmc);
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index ca38569..bff8d46 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -215,7 +215,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ 
+ 	mutex_lock(&dev->lock);
+ 
+-	if (dev->open++)
++	if (dev->open)
+ 		goto unlock;
+ 
+ 	kref_get(&dev->ref);
+@@ -235,6 +235,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ 		goto error_release;
+ 
+ unlock:
++	dev->open++;
+ 	mutex_unlock(&dev->lock);
+ 	blktrans_dev_put(dev);
+ 	return ret;
+diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
+index e3e40f4..43130e8 100644
+--- a/drivers/mtd/mtdoops.c
++++ b/drivers/mtd/mtdoops.c
+@@ -253,6 +253,9 @@ static void find_next_position(struct mtdoops_context *cxt)
+ 	size_t retlen;
+ 
+ 	for (page = 0; page < cxt->oops_pages; page++) {
++		if (mtd->block_isbad &&
++		    mtd->block_isbad(mtd, page * record_size))
++			continue;
+ 		/* Assume the page is used */
+ 		mark_page_used(cxt, page);
+ 		ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
+@@ -369,7 +372,7 @@ static void mtdoops_notify_add(struct mtd_info *mtd)
+ 
+ 	/* oops_page_used is a bit field */
+ 	cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+-			BITS_PER_LONG));
++			BITS_PER_LONG) * sizeof(unsigned long));
+ 	if (!cxt->oops_page_used) {
+ 		printk(KERN_ERR "mtdoops: could not allocate page array\n");
+ 		return;
+diff --git a/drivers/mtd/tests/mtd_stresstest.c b/drivers/mtd/tests/mtd_stresstest.c
+index 531625f..129bad2 100644
+--- a/drivers/mtd/tests/mtd_stresstest.c
++++ b/drivers/mtd/tests/mtd_stresstest.c
+@@ -277,6 +277,12 @@ static int __init mtd_stresstest_init(void)
+ 	       (unsigned long long)mtd->size, mtd->erasesize,
+ 	       pgsize, ebcnt, pgcnt, mtd->oobsize);
+ 
++	if (ebcnt < 2) {
++		printk(PRINT_PREF "error: need at least 2 eraseblocks\n");
++		err = -ENOSPC;
++		goto out_put_mtd;
++	}
++
+ 	/* Read or write up 2 eraseblocks at a time */
+ 	bufsize = mtd->erasesize * 2;
+ 
+@@ -315,6 +321,7 @@ out:
+ 	kfree(bbt);
+ 	vfree(writebuf);
+ 	vfree(readbuf);
++out_put_mtd:
+ 	put_mtd_device(mtd);
+ 	if (err)
+ 		printk(PRINT_PREF "error %d occurred\n", err);
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index 191f3bb..cdea669 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -628,6 +628,9 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
+ 	if (req->alignment != 1 && n)
+ 		goto bad;
+ 
++	if (!req->name[0] || !req->name_len)
++		goto bad;
++
+ 	if (req->name_len > UBI_VOL_NAME_MAX) {
+ 		err = -ENAMETOOLONG;
+ 		goto bad;
+diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
+index 3f1a09c..5f0e4c2 100644
+--- a/drivers/mtd/ubi/debug.h
++++ b/drivers/mtd/ubi/debug.h
+@@ -51,7 +51,10 @@ struct ubi_mkvol_req;
+ 	pr_debug("UBI DBG " type ": " fmt "\n", ##__VA_ARGS__)
+ 
+ /* Just a debugging messages not related to any specific UBI subsystem */
+-#define dbg_msg(fmt, ...) ubi_dbg_msg("msg", fmt, ##__VA_ARGS__)
++#define dbg_msg(fmt, ...)                                    \
++	printk(KERN_DEBUG "UBI DBG (pid %d): %s: " fmt "\n", \
++	       current->pid, __func__, ##__VA_ARGS__)
++
+ /* General debugging messages */
+ #define dbg_gen(fmt, ...) ubi_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Messages from the eraseblock association sub-system */
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index 4be6718..c696c94 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1028,12 +1028,14 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
+ 	 * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
+ 	 * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
+ 	 * LEB is already locked, we just do not move it and return
+-	 * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.
++	 * %MOVE_RETRY. Note, we do not return %MOVE_CANCEL_RACE here because
++	 * we do not know the reasons of the contention - it may be just a
++	 * normal I/O on this LEB, so we want to re-try.
+ 	 */
+ 	err = leb_write_trylock(ubi, vol_id, lnum);
+ 	if (err) {
+ 		dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
+-		return MOVE_CANCEL_RACE;
++		return MOVE_RETRY;
+ 	}
+ 
+ 	/*
+diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
+index c6c2229..bbfa88d 100644
+--- a/drivers/mtd/ubi/ubi.h
++++ b/drivers/mtd/ubi/ubi.h
+@@ -121,6 +121,7 @@ enum {
+  *                     PEB
+  * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the
+  *                       target PEB
++ * MOVE_RETRY: retry scrubbing the PEB
+  */
+ enum {
+ 	MOVE_CANCEL_RACE = 1,
+@@ -128,6 +129,7 @@ enum {
+ 	MOVE_TARGET_RD_ERR,
+ 	MOVE_TARGET_WR_ERR,
+ 	MOVE_CANCEL_BITFLIPS,
++	MOVE_RETRY,
+ };
+ 
+ /**
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index ff2c495..12e44c9 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -792,7 +792,10 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ 			protect = 1;
+ 			goto out_not_moved;
+ 		}
+-
++		if (err == MOVE_RETRY) {
++			scrubbing = 1;
++			goto out_not_moved;
++		}
+ 		if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
+ 		    err == MOVE_TARGET_RD_ERR) {
+ 			/*
+@@ -1046,7 +1049,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ 
+ 	ubi_err("failed to erase PEB %d, error %d", pnum, err);
+ 	kfree(wl_wrk);
+-	kmem_cache_free(ubi_wl_entry_slab, e);
+ 
+ 	if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
+ 	    err == -EBUSY) {
+@@ -1059,14 +1061,16 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
+ 			goto out_ro;
+ 		}
+ 		return err;
+-	} else if (err != -EIO) {
++	}
++
++	kmem_cache_free(ubi_wl_entry_slab, e);
++	if (err != -EIO)
+ 		/*
+ 		 * If this is not %-EIO, we have no idea what to do. Scheduling
+ 		 * this physical eraseblock for erasure again would cause
+ 		 * errors again and again. Well, lets switch to R/O mode.
+ 		 */
+ 		goto out_ro;
+-	}
+ 
+ 	/* It is %-EIO, the PEB went bad */
+ 
+diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
+index 47c8339a..2843c90 100644
+--- a/drivers/net/phy/mdio-gpio.c
++++ b/drivers/net/phy/mdio-gpio.c
+@@ -241,7 +241,7 @@ MODULE_DEVICE_TABLE(of, mdio_ofgpio_match);
+ 
+ static struct platform_driver mdio_ofgpio_driver = {
+ 	.driver = {
+-		.name = "mdio-gpio",
++		.name = "mdio-ofgpio",
+ 		.owner = THIS_MODULE,
+ 		.of_match_table = mdio_ofgpio_match,
+ 	},
+diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+index 421d5c8..a935585 100644
+--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
+@@ -2910,14 +2910,13 @@ int iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
+ 		IWL_WARN(priv, "Invalid scan band\n");
+ 		return -EIO;
+ 	}
+-
+ 	/*
+-	 * If active scaning is requested but a certain channel
+-	 * is marked passive, we can do active scanning if we
+-	 * detect transmissions.
++	 * If active scaning is requested but a certain channel is marked
++	 * passive, we can do active scanning if we detect transmissions. For
++	 * passive only scanning disable switching to active on any channel.
+ 	 */
+ 	scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+-					IWL_GOOD_CRC_TH_DISABLED;
++					IWL_GOOD_CRC_TH_NEVER;
+ 
+ 	if (!priv->is_internal_short_scan) {
+ 		scan->tx_cmd.len = cpu_to_le16(
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+index f803fb6..857cf61 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+@@ -2023,6 +2023,7 @@ static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+ 	case IEEE80211_SMPS_STATIC:
+ 	case IEEE80211_SMPS_DYNAMIC:
+ 		return IWL_NUM_IDLE_CHAINS_SINGLE;
++	case IEEE80211_SMPS_AUTOMATIC:
+ 	case IEEE80211_SMPS_OFF:
+ 		return active_cnt;
+ 	default:
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index 39a3c9c..272bcdf 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -442,6 +442,9 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
+ 
+ 	mutex_lock(&priv->mutex);
+ 
++	if (test_bit(STATUS_EXIT_PENDING, &priv->status))
++		goto out;
++
+ 	if (unlikely(test_bit(STATUS_SCANNING, &priv->status))) {
+ 		IWL_DEBUG_MAC80211(priv, "leave - scanning\n");
+ 		goto out;
+diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
+index 55cd3e1..dab7dc1 100644
+--- a/drivers/net/wireless/rt2x00/rt2800pci.c
++++ b/drivers/net/wireless/rt2x00/rt2800pci.c
+@@ -426,7 +426,6 @@ static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
+ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+ 				 enum dev_state state)
+ {
+-	int mask = (state == STATE_RADIO_IRQ_ON);
+ 	u32 reg;
+ 	unsigned long flags;
+ 
+@@ -448,25 +447,14 @@ static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+ 	}
+ 
+ 	spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
+-	rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_RX_DONE, mask);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_TBTT, mask);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_PRE_TBTT, mask);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, mask);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, mask);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, 0);
+-	rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, 0);
++	reg = 0;
++	if (state == STATE_RADIO_IRQ_ON) {
++		rt2x00_set_field32(&reg, INT_MASK_CSR_RX_DONE, 1);
++		rt2x00_set_field32(&reg, INT_MASK_CSR_TBTT, 1);
++		rt2x00_set_field32(&reg, INT_MASK_CSR_PRE_TBTT, 1);
++		rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, 1);
++		rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, 1);
++	}
+ 	rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+ 	spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
+ 
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+index 3b5af01..0c77a14 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+@@ -196,6 +196,8 @@ static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw,
+ 		/* Allocate skb buffer to contain firmware */
+ 		/* info and tx descriptor info. */
+ 		skb = dev_alloc_skb(frag_length);
++		if (!skb)
++			return false;
+ 		skb_reserve(skb, extra_descoffset);
+ 		seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length -
+ 					extra_descoffset));
+@@ -575,6 +577,8 @@ static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd,
+ 
+ 	len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len);
+ 	skb = dev_alloc_skb(len);
++	if (!skb)
++		return false;
+ 	cb_desc = (struct rtl_tcb_desc *)(skb->cb);
+ 	cb_desc->queue_index = TXCMD_QUEUE;
+ 	cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL;
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 2f10328..e174982 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -869,5 +869,15 @@ EXPORT_SYMBOL(pci_msi_enabled);
+ 
+ void pci_msi_init_pci_dev(struct pci_dev *dev)
+ {
++	int pos;
+ 	INIT_LIST_HEAD(&dev->msi_list);
++
++	/* Disable the msi hardware to avoid screaming interrupts
++	 * during boot.  This is the power on reset default so
++	 * usually this should be a noop.
++	 */
++	pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
++	if (pos)
++		msi_set_enable(dev, pos, 0);
++	msix_set_enable(dev, 0);
+ }
+diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
+index dfbd5a6..258fef2 100644
+--- a/drivers/pnp/quirks.c
++++ b/drivers/pnp/quirks.c
+@@ -295,6 +295,45 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
+ 	}
+ }
+ 
++#ifdef CONFIG_AMD_NB
++
++#include <asm/amd_nb.h>
++
++static void quirk_amd_mmconfig_area(struct pnp_dev *dev)
++{
++	resource_size_t start, end;
++	struct pnp_resource *pnp_res;
++	struct resource *res;
++	struct resource mmconfig_res, *mmconfig;
++
++	mmconfig = amd_get_mmconfig_range(&mmconfig_res);
++	if (!mmconfig)
++		return;
++
++	list_for_each_entry(pnp_res, &dev->resources, list) {
++		res = &pnp_res->res;
++		if (res->end < mmconfig->start || res->start > mmconfig->end ||
++		    (res->start == mmconfig->start && res->end == mmconfig->end))
++			continue;
++
++		dev_info(&dev->dev, FW_BUG
++			 "%pR covers only part of AMD MMCONFIG area %pR; adding more reservations\n",
++			 res, mmconfig);
++		if (mmconfig->start < res->start) {
++			start = mmconfig->start;
++			end = res->start - 1;
++			pnp_add_mem_resource(dev, start, end, 0);
++		}
++		if (mmconfig->end > res->end) {
++			start = res->end + 1;
++			end = mmconfig->end;
++			pnp_add_mem_resource(dev, start, end, 0);
++		}
++		break;
++	}
++}
++#endif
++
+ /*
+  *  PnP Quirks
+  *  Cards or devices that need some tweaking due to incomplete resource info
+@@ -322,6 +361,9 @@ static struct pnp_fixup pnp_fixups[] = {
+ 	/* PnP resources that might overlap PCI BARs */
+ 	{"PNP0c01", quirk_system_pci_resources},
+ 	{"PNP0c02", quirk_system_pci_resources},
++#ifdef CONFIG_AMD_NB
++	{"PNP0c01", quirk_amd_mmconfig_area},
++#endif
+ 	{""}
+ };
+ 
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index eb4c883..38d1dc7 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -227,11 +227,11 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ 		alarm->time.tm_hour = now.tm_hour;
+ 
+ 	/* For simplicity, only support date rollover for now */
+-	if (alarm->time.tm_mday == -1) {
++	if (alarm->time.tm_mday < 1 || alarm->time.tm_mday > 31) {
+ 		alarm->time.tm_mday = now.tm_mday;
+ 		missing = day;
+ 	}
+-	if (alarm->time.tm_mon == -1) {
++	if ((unsigned)alarm->time.tm_mon >= 12) {
+ 		alarm->time.tm_mon = now.tm_mon;
+ 		if (missing == none)
+ 			missing = month;
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index 39e81cd..10f16a3 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -66,6 +66,8 @@ static MPT_CALLBACK	mpt_callbacks[MPT_MAX_CALLBACKS];
+ 
+ #define FAULT_POLLING_INTERVAL 1000 /* in milliseconds */
+ 
++#define MAX_HBA_QUEUE_DEPTH	30000
++#define MAX_CHAIN_DEPTH		100000
+ static int max_queue_depth = -1;
+ module_param(max_queue_depth, int, 0);
+ MODULE_PARM_DESC(max_queue_depth, " max controller queue depth ");
+@@ -2098,8 +2100,6 @@ _base_release_memory_pools(struct MPT2SAS_ADAPTER *ioc)
+ 		}
+ 		if (ioc->chain_dma_pool)
+ 			pci_pool_destroy(ioc->chain_dma_pool);
+-	}
+-	if (ioc->chain_lookup) {
+ 		free_pages((ulong)ioc->chain_lookup, ioc->chain_pages);
+ 		ioc->chain_lookup = NULL;
+ 	}
+@@ -2117,9 +2117,7 @@ static int
+ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
+ {
+ 	struct mpt2sas_facts *facts;
+-	u32 queue_size, queue_diff;
+ 	u16 max_sge_elements;
+-	u16 num_of_reply_frames;
+ 	u16 chains_needed_per_io;
+ 	u32 sz, total_sz;
+ 	u32 retry_sz;
+@@ -2146,7 +2144,8 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
+ 		max_request_credit = (max_queue_depth < facts->RequestCredit)
+ 		    ? max_queue_depth : facts->RequestCredit;
+ 	else
+-		max_request_credit = facts->RequestCredit;
++		max_request_credit = min_t(u16, facts->RequestCredit,
++		    MAX_HBA_QUEUE_DEPTH);
+ 
+ 	ioc->hba_queue_depth = max_request_credit;
+ 	ioc->hi_priority_depth = facts->HighPriorityCredit;
+@@ -2187,50 +2186,25 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
+ 	}
+ 	ioc->chains_needed_per_io = chains_needed_per_io;
+ 
+-	/* reply free queue sizing - taking into account for events */
+-	num_of_reply_frames = ioc->hba_queue_depth + 32;
+-
+-	/* number of replies frames can't be a multiple of 16 */
+-	/* decrease number of reply frames by 1 */
+-	if (!(num_of_reply_frames % 16))
+-		num_of_reply_frames--;
+-
+-	/* calculate number of reply free queue entries
+-	 *  (must be multiple of 16)
+-	 */
+-
+-	/* (we know reply_free_queue_depth is not a multiple of 16) */
+-	queue_size = num_of_reply_frames;
+-	queue_size += 16 - (queue_size % 16);
+-	ioc->reply_free_queue_depth = queue_size;
+-
+-	/* reply descriptor post queue sizing */
+-	/* this size should be the number of request frames + number of reply
+-	 * frames
+-	 */
+-
+-	queue_size = ioc->hba_queue_depth + num_of_reply_frames + 1;
+-	/* round up to 16 byte boundary */
+-	if (queue_size % 16)
+-		queue_size += 16 - (queue_size % 16);
+-
+-	/* check against IOC maximum reply post queue depth */
+-	if (queue_size > facts->MaxReplyDescriptorPostQueueDepth) {
+-		queue_diff = queue_size -
+-		    facts->MaxReplyDescriptorPostQueueDepth;
++	/* reply free queue sizing - taking into account for 64 FW events */
++	ioc->reply_free_queue_depth = ioc->hba_queue_depth + 64;
+ 
+-		/* round queue_diff up to multiple of 16 */
+-		if (queue_diff % 16)
+-			queue_diff += 16 - (queue_diff % 16);
+-
+-		/* adjust hba_queue_depth, reply_free_queue_depth,
+-		 * and queue_size
+-		 */
+-		ioc->hba_queue_depth -= (queue_diff / 2);
+-		ioc->reply_free_queue_depth -= (queue_diff / 2);
+-		queue_size = facts->MaxReplyDescriptorPostQueueDepth;
++	/* align the reply post queue on the next 16 count boundary */
++	if (!ioc->reply_free_queue_depth % 16)
++		ioc->reply_post_queue_depth = ioc->reply_free_queue_depth + 16;
++	else
++		ioc->reply_post_queue_depth = ioc->reply_free_queue_depth +
++				32 - (ioc->reply_free_queue_depth % 16);
++	if (ioc->reply_post_queue_depth >
++	    facts->MaxReplyDescriptorPostQueueDepth) {
++		ioc->reply_post_queue_depth = min_t(u16,
++		    (facts->MaxReplyDescriptorPostQueueDepth -
++		    (facts->MaxReplyDescriptorPostQueueDepth % 16)),
++		    (ioc->hba_queue_depth - (ioc->hba_queue_depth % 16)));
++		ioc->reply_free_queue_depth = ioc->reply_post_queue_depth - 16;
++		ioc->hba_queue_depth = ioc->reply_free_queue_depth - 64;
+ 	}
+-	ioc->reply_post_queue_depth = queue_size;
++
+ 
+ 	dinitprintk(ioc, printk(MPT2SAS_INFO_FMT "scatter gather: "
+ 	    "sge_in_main_msg(%d), sge_per_chain(%d), sge_per_io(%d), "
+@@ -2316,15 +2290,12 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
+ 	    "depth(%d)\n", ioc->name, ioc->request,
+ 	    ioc->scsiio_depth));
+ 
+-	/* loop till the allocation succeeds */
+-	do {
+-		sz = ioc->chain_depth * sizeof(struct chain_tracker);
+-		ioc->chain_pages = get_order(sz);
+-		ioc->chain_lookup = (struct chain_tracker *)__get_free_pages(
+-		    GFP_KERNEL, ioc->chain_pages);
+-		if (ioc->chain_lookup == NULL)
+-			ioc->chain_depth -= 100;
+-	} while (ioc->chain_lookup == NULL);
++	ioc->chain_depth = min_t(u32, ioc->chain_depth, MAX_CHAIN_DEPTH);
++	sz = ioc->chain_depth * sizeof(struct chain_tracker);
++	ioc->chain_pages = get_order(sz);
++
++	ioc->chain_lookup = (struct chain_tracker *)__get_free_pages(
++	    GFP_KERNEL, ioc->chain_pages);
+ 	ioc->chain_dma_pool = pci_pool_create("chain pool", ioc->pdev,
+ 	    ioc->request_sz, 16, 0);
+ 	if (!ioc->chain_dma_pool) {
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index c79857e..aa51195 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -974,8 +974,8 @@ _scsih_get_chain_buffer_tracker(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+ 	spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+ 	if (list_empty(&ioc->free_chain_list)) {
+ 		spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+-		printk(MPT2SAS_WARN_FMT "chain buffers not available\n",
+-		    ioc->name);
++		dfailprintk(ioc, printk(MPT2SAS_WARN_FMT "chain buffers not "
++			"available\n", ioc->name));
+ 		return NULL;
+ 	}
+ 	chain_req = list_entry(ioc->free_chain_list.next,
+@@ -6425,6 +6425,7 @@ _scsih_mark_responding_raid_device(struct MPT2SAS_ADAPTER *ioc, u64 wwid,
+ 			} else
+ 				sas_target_priv_data = NULL;
+ 			raid_device->responding = 1;
++			spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ 			starget_printk(KERN_INFO, raid_device->starget,
+ 			    "handle(0x%04x), wwid(0x%016llx)\n", handle,
+ 			    (unsigned long long)raid_device->wwid);
+@@ -6435,16 +6436,16 @@ _scsih_mark_responding_raid_device(struct MPT2SAS_ADAPTER *ioc, u64 wwid,
+ 			 */
+ 			_scsih_init_warpdrive_properties(ioc, raid_device);
+ 			if (raid_device->handle == handle)
+-				goto out;
++				return;
+ 			printk(KERN_INFO "\thandle changed from(0x%04x)!!!\n",
+ 			    raid_device->handle);
+ 			raid_device->handle = handle;
+ 			if (sas_target_priv_data)
+ 				sas_target_priv_data->handle = handle;
+-			goto out;
++			return;
+ 		}
+ 	}
+- out:
++
+ 	spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ }
+ 
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 953773c..7d8b5d8 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1073,6 +1073,10 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+ 	SCSI_LOG_IOCTL(1, printk("sd_ioctl: disk=%s, cmd=0x%x\n",
+ 						disk->disk_name, cmd));
+ 
++	error = scsi_verify_blk_ioctl(bdev, cmd);
++	if (error < 0)
++		return error;
++
+ 	/*
+ 	 * If we are in the middle of error recovery, don't let anyone
+ 	 * else try and use this device.  Also, if error recovery fails, it
+@@ -1095,7 +1099,7 @@ static int sd_ioctl(struct block_device *bdev, fmode_t mode,
+ 			error = scsi_ioctl(sdp, cmd, p);
+ 			break;
+ 		default:
+-			error = scsi_cmd_ioctl(disk->queue, disk, mode, cmd, p);
++			error = scsi_cmd_blk_ioctl(bdev, mode, cmd, p);
+ 			if (error != -ENOTTY)
+ 				break;
+ 			error = scsi_ioctl(sdp, cmd, p);
+@@ -1265,6 +1269,11 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ 			   unsigned int cmd, unsigned long arg)
+ {
+ 	struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
++	int ret;
++
++	ret = scsi_verify_blk_ioctl(bdev, cmd);
++	if (ret < 0)
++		return -ENOIOCTLCMD;
+ 
+ 	/*
+ 	 * If we are in the middle of error recovery, don't let anyone
+@@ -1276,8 +1285,6 @@ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ 		return -ENODEV;
+ 	       
+ 	if (sdev->host->hostt->compat_ioctl) {
+-		int ret;
+-
+ 		ret = sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
+ 
+ 		return ret;
+diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
+index b4543f5..36d1ed7 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
++++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
+@@ -839,6 +839,10 @@ static void sym53c8xx_slave_destroy(struct scsi_device *sdev)
+ 	struct sym_lcb *lp = sym_lp(tp, sdev->lun);
+ 	unsigned long flags;
+ 
++	/* if slave_alloc returned before allocating a sym_lcb, return */
++	if (!lp)
++		return;
++
+ 	spin_lock_irqsave(np->s.host->host_lock, flags);
+ 
+ 	if (lp->busy_itlq || lp->busy_itl) {
+diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
+index 7f19c8b..f044d45 100644
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -84,6 +84,18 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
+ 	buf[2] = dev->transport->get_device_rev(dev);
+ 
+ 	/*
++	 * NORMACA and HISUP = 0, RESPONSE DATA FORMAT = 2
++	 *
++	 * SPC4 says:
++	 *   A RESPONSE DATA FORMAT field set to 2h indicates that the
++	 *   standard INQUIRY data is in the format defined in this
++	 *   standard. Response data format values less than 2h are
++	 *   obsolete. Response data format values greater than 2h are
++	 *   reserved.
++	 */
++	buf[3] = 2;
++
++	/*
+ 	 * Enable SCCS and TPGS fields for Emulated ALUA
+ 	 */
+ 	if (T10_ALUA(dev->se_sub_dev)->alua_type == SPC3_ALUA_EMULATED)
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 1340ffd..bb86655 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -5668,6 +5668,8 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_SECTOR_COUNT_TOO_MANY:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ILLEGAL REQUEST */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ 		/* INVALID COMMAND OPERATION CODE */
+@@ -5676,6 +5678,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_UNKNOWN_MODE_PAGE:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ILLEGAL REQUEST */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ 		/* INVALID FIELD IN CDB */
+@@ -5684,6 +5687,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_CHECK_CONDITION_ABORT_CMD:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* BUS DEVICE RESET FUNCTION OCCURRED */
+@@ -5693,6 +5697,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_INCORRECT_AMOUNT_OF_DATA:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* WRITE ERROR */
+@@ -5703,6 +5708,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_INVALID_CDB_FIELD:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* INVALID FIELD IN CDB */
+@@ -5711,6 +5717,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_INVALID_PARAMETER_LIST:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* INVALID FIELD IN PARAMETER LIST */
+@@ -5719,6 +5726,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_UNEXPECTED_UNSOLICITED_DATA:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* WRITE ERROR */
+@@ -5729,6 +5737,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_SERVICE_CRC_ERROR:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* PROTOCOL SERVICE CRC ERROR */
+@@ -5739,6 +5748,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_SNACK_REJECTED:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ABORTED COMMAND */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
+ 		/* READ ERROR */
+@@ -5749,6 +5759,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_WRITE_PROTECTED:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* DATA PROTECT */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = DATA_PROTECT;
+ 		/* WRITE PROTECTED */
+@@ -5757,6 +5768,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_CHECK_CONDITION_UNIT_ATTENTION:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* UNIT ATTENTION */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
+ 		core_scsi3_ua_for_check_condition(cmd, &asc, &ascq);
+@@ -5766,6 +5778,7 @@ int transport_send_check_condition_and_sense(
+ 	case TCM_CHECK_CONDITION_NOT_READY:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* Not Ready */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = NOT_READY;
+ 		transport_get_sense_codes(cmd, &asc, &ascq);
+@@ -5776,6 +5789,7 @@ int transport_send_check_condition_and_sense(
+ 	default:
+ 		/* CURRENT ERROR */
+ 		buffer[offset] = 0x70;
++		buffer[offset+SPC_ADD_SENSE_LEN_OFFSET] = 10;
+ 		/* ILLEGAL REQUEST */
+ 		buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+ 		/* LOGICAL UNIT COMMUNICATION FAILURE */
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index 5534690..daee5db 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -801,6 +801,12 @@ static int process_msg(void)
+ 		goto out;
+ 	}
+ 
++	if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
++		kfree(msg);
++		err = -EINVAL;
++		goto out;
++	}
++
+ 	body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
+ 	if (body == NULL) {
+ 		kfree(msg);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index d2f8feb..f598b98 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -241,6 +241,7 @@ static void dentry_lru_add(struct dentry *dentry)
+ static void __dentry_lru_del(struct dentry *dentry)
+ {
+ 	list_del_init(&dentry->d_lru);
++	dentry->d_flags &= ~DCACHE_SHRINK_LIST;
+ 	dentry->d_sb->s_nr_dentry_unused--;
+ 	dentry_stat.nr_unused--;
+ }
+@@ -753,6 +754,7 @@ relock:
+ 			spin_unlock(&dentry->d_lock);
+ 		} else {
+ 			list_move_tail(&dentry->d_lru, &tmp);
++			dentry->d_flags |= DCACHE_SHRINK_LIST;
+ 			spin_unlock(&dentry->d_lock);
+ 			if (!--cnt)
+ 				break;
+@@ -1144,14 +1146,18 @@ resume:
+ 		/* 
+ 		 * move only zero ref count dentries to the end 
+ 		 * of the unused list for prune_dcache
++		 *
++		 * Those which are presently on the shrink list, being processed
++		 * by shrink_dentry_list(), shouldn't be moved.  Otherwise the
++		 * loop in shrink_dcache_parent() might not make any progress
++		 * and loop forever.
+ 		 */
+-		if (!dentry->d_count) {
++		if (dentry->d_count) {
++			dentry_lru_del(dentry);
++		} else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
+ 			dentry_lru_move_tail(dentry);
+ 			found++;
+-		} else {
+-			dentry_lru_del(dentry);
+ 		}
+-
+ 		/*
+ 		 * We can return to the caller if we have found some (this
+ 		 * ensures forward progress). We'll be coming back to find
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 7aa77f0..df121b2 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1957,17 +1957,16 @@ static int ext4_fill_flex_info(struct super_block *sb)
+ 	struct ext4_group_desc *gdp = NULL;
+ 	ext4_group_t flex_group_count;
+ 	ext4_group_t flex_group;
+-	int groups_per_flex = 0;
++	unsigned int groups_per_flex = 0;
+ 	size_t size;
+ 	int i;
+ 
+ 	sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+-	groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+-
+-	if (groups_per_flex < 2) {
++	if (sbi->s_log_groups_per_flex < 1 || sbi->s_log_groups_per_flex > 31) {
+ 		sbi->s_log_groups_per_flex = 0;
+ 		return 1;
+ 	}
++	groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+ 
+ 	/* We allocate both existing and potentially added groups */
+ 	flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index aaa09e9..b5c826e 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -324,7 +324,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
+ 	dprintk("%s enter. slotid %d seqid %d\n",
+ 		__func__, args->csa_slotid, args->csa_sequenceid);
+ 
+-	if (args->csa_slotid > NFS41_BC_MAX_CALLBACKS)
++	if (args->csa_slotid >= NFS41_BC_MAX_CALLBACKS)
+ 		return htonl(NFS4ERR_BADSLOT);
+ 
+ 	slot = tbl->slots + args->csa_slotid;
+diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
+index 1d1dc1e..75fe694 100644
+--- a/fs/nfs/objlayout/objio_osd.c
++++ b/fs/nfs/objlayout/objio_osd.c
+@@ -1006,7 +1006,8 @@ static bool objio_pg_test(struct nfs_pageio_descriptor *pgio,
+ static struct pnfs_layoutdriver_type objlayout_type = {
+ 	.id = LAYOUT_OSD2_OBJECTS,
+ 	.name = "LAYOUT_OSD2_OBJECTS",
+-	.flags                   = PNFS_LAYOUTRET_ON_SETATTR,
++	.flags                   = PNFS_LAYOUTRET_ON_SETATTR |
++				   PNFS_LAYOUTRET_ON_ERROR,
+ 
+ 	.alloc_layout_hdr        = objlayout_alloc_layout_hdr,
+ 	.free_layout_hdr         = objlayout_free_layout_hdr,
+diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
+index 1d06f8e..fefa122 100644
+--- a/fs/nfs/objlayout/objlayout.c
++++ b/fs/nfs/objlayout/objlayout.c
+@@ -294,9 +294,11 @@ objlayout_read_done(struct objlayout_io_state *state, ssize_t status, bool sync)
+ 	dprintk("%s: Begin status=%zd eof=%d\n", __func__, status, eof);
+ 	rdata = state->rpcdata;
+ 	rdata->task.tk_status = status;
+-	if (status >= 0) {
++	if (likely(status >= 0)) {
+ 		rdata->res.count = status;
+ 		rdata->res.eof = eof;
++	} else {
++		rdata->pnfs_error = status;
+ 	}
+ 	objlayout_iodone(state);
+ 	/* must not use state after this point */
+@@ -380,15 +382,17 @@ objlayout_write_done(struct objlayout_io_state *state, ssize_t status,
+ 	wdata = state->rpcdata;
+ 	state->status = status;
+ 	wdata->task.tk_status = status;
+-	if (status >= 0) {
++	if (likely(status >= 0)) {
+ 		wdata->res.count = status;
+ 		wdata->verf.committed = state->committed;
+ 		dprintk("%s: Return status %d committed %d\n",
+ 			__func__, wdata->task.tk_status,
+ 			wdata->verf.committed);
+-	} else
++	} else {
++		wdata->pnfs_error = status;
+ 		dprintk("%s: Return status %d\n",
+ 			__func__, wdata->task.tk_status);
++	}
+ 	objlayout_iodone(state);
+ 	/* must not use state after this point */
+ 
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 36d2a29..9951887 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1119,6 +1119,14 @@ pnfs_ld_write_done(struct nfs_write_data *data)
+ 		data->mds_ops->rpc_release(data);
+ 		return 0;
+ 	}
++	if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
++					PNFS_LAYOUTRET_ON_ERROR) {
++		/* Don't lo_commit on error, Server will needs to
++		 * preform a file recovery.
++		 */
++		clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(data->inode)->flags);
++		pnfs_return_layout(data->inode);
++	}
+ 
+ 	dprintk("%s: pnfs_error=%d, retry via MDS\n", __func__,
+ 		data->pnfs_error);
+@@ -1167,6 +1175,10 @@ pnfs_ld_read_done(struct nfs_read_data *data)
+ 		return 0;
+ 	}
+ 
++	if (NFS_SERVER(data->inode)->pnfs_curr_ld->flags &
++						PNFS_LAYOUTRET_ON_ERROR)
++		pnfs_return_layout(data->inode);
++
+ 	dprintk("%s: pnfs_error=%d, retry via MDS\n", __func__,
+ 		data->pnfs_error);
+ 	status = nfs_initiate_read(data, NFS_CLIENT(data->inode),
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 9d147d9..bb8b324 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -68,6 +68,7 @@ enum {
+ enum layoutdriver_policy_flags {
+ 	/* Should the pNFS client commit and return the layout upon a setattr */
+ 	PNFS_LAYOUTRET_ON_SETATTR	= 1 << 0,
++	PNFS_LAYOUTRET_ON_ERROR		= 1 << 1,
+ };
+ 
+ struct nfs4_deviceid_node;
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 858d31b..7e8b07d 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -904,10 +904,24 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(unsigned int ve
+ 		data->auth_flavor_len	= 1;
+ 		data->version		= version;
+ 		data->minorversion	= 0;
++		security_init_mnt_opts(&data->lsm_opts);
+ 	}
+ 	return data;
+ }
+ 
++static void nfs_free_parsed_mount_data(struct nfs_parsed_mount_data *data)
++{
++	if (data) {
++		kfree(data->client_address);
++		kfree(data->mount_server.hostname);
++		kfree(data->nfs_server.export_path);
++		kfree(data->nfs_server.hostname);
++		kfree(data->fscache_uniq);
++		security_free_mnt_opts(&data->lsm_opts);
++		kfree(data);
++	}
++}
++
+ /*
+  * Sanity-check a server address provided by the mount command.
+  *
+@@ -2218,9 +2232,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ 	data = nfs_alloc_parsed_mount_data(NFS_DEFAULT_VERSION);
+ 	mntfh = nfs_alloc_fhandle();
+ 	if (data == NULL || mntfh == NULL)
+-		goto out_free_fh;
+-
+-	security_init_mnt_opts(&data->lsm_opts);
++		goto out;
+ 
+ 	/* Validate the mount data */
+ 	error = nfs_validate_mount_data(raw_data, data, mntfh, dev_name);
+@@ -2232,8 +2244,6 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ #ifdef CONFIG_NFS_V4
+ 	if (data->version == 4) {
+ 		mntroot = nfs4_try_mount(flags, dev_name, data);
+-		kfree(data->client_address);
+-		kfree(data->nfs_server.export_path);
+ 		goto out;
+ 	}
+ #endif	/* CONFIG_NFS_V4 */
+@@ -2284,13 +2294,8 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
+ 	s->s_flags |= MS_ACTIVE;
+ 
+ out:
+-	kfree(data->nfs_server.hostname);
+-	kfree(data->mount_server.hostname);
+-	kfree(data->fscache_uniq);
+-	security_free_mnt_opts(&data->lsm_opts);
+-out_free_fh:
++	nfs_free_parsed_mount_data(data);
+ 	nfs_free_fhandle(mntfh);
+-	kfree(data);
+ 	return mntroot;
+ 
+ out_err_nosb:
+@@ -2613,9 +2618,7 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
+ 
+ 	mntfh = nfs_alloc_fhandle();
+ 	if (data == NULL || mntfh == NULL)
+-		goto out_free_fh;
+-
+-	security_init_mnt_opts(&data->lsm_opts);
++		goto out;
+ 
+ 	/* Get a volume representation */
+ 	server = nfs4_create_server(data, mntfh);
+@@ -2663,13 +2666,10 @@ nfs4_remote_mount(struct file_system_type *fs_type, int flags,
+ 
+ 	s->s_flags |= MS_ACTIVE;
+ 
+-	security_free_mnt_opts(&data->lsm_opts);
+ 	nfs_free_fhandle(mntfh);
+ 	return mntroot;
+ 
+ out:
+-	security_free_mnt_opts(&data->lsm_opts);
+-out_free_fh:
+ 	nfs_free_fhandle(mntfh);
+ 	return ERR_PTR(error);
+ 
+@@ -2855,7 +2855,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
+ 
+ 	data = nfs_alloc_parsed_mount_data(4);
+ 	if (data == NULL)
+-		goto out_free_data;
++		goto out;
+ 
+ 	/* Validate the mount data */
+ 	error = nfs4_validate_mount_data(raw_data, data, dev_name);
+@@ -2869,12 +2869,7 @@ static struct dentry *nfs4_mount(struct file_system_type *fs_type,
+ 		error = PTR_ERR(res);
+ 
+ out:
+-	kfree(data->client_address);
+-	kfree(data->nfs_server.export_path);
+-	kfree(data->nfs_server.hostname);
+-	kfree(data->fscache_uniq);
+-out_free_data:
+-	kfree(data);
++	nfs_free_parsed_mount_data(data);
+ 	dprintk("<-- nfs4_mount() = %d%s\n", error,
+ 			error != 0 ? " [error]" : "");
+ 	return res;
+diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
+index b9566e4..4b470f6 100644
+--- a/fs/nfsd/export.c
++++ b/fs/nfsd/export.c
+@@ -88,7 +88,7 @@ static int expkey_parse(struct cache_detail *cd, char *mesg, int mlen)
+ 	struct svc_expkey key;
+ 	struct svc_expkey *ek = NULL;
+ 
+-	if (mesg[mlen-1] != '\n')
++	if (mlen < 1 || mesg[mlen-1] != '\n')
+ 		return -EINVAL;
+ 	mesg[mlen-1] = 0;
+ 
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 252ab1f..42ed195 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+ 
+ 	mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
+ 
+-	/* 1 from caller and 1 for being on i_list/g_list */
+-	BUG_ON(atomic_read(&mark->refcnt) < 2);
+-
+ 	spin_lock(&group->mark_lock);
+ 
+ 	if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
+@@ -182,6 +179,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+ 		iput(inode);
+ 
+ 	/*
++	 * We don't necessarily have a ref on mark from caller so the above iput
++	 * may have already destroyed it.  Don't touch from now on.
++	 */
++
++	/*
+ 	 * it's possible that this group tried to destroy itself, but this
+ 	 * this mark was simultaneously being freed by inode.  If that's the
+ 	 * case, we finish freeing the group here.
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index f039017..7b28f27 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -194,65 +194,7 @@ static int proc_root_link(struct inode *inode, struct path *path)
+ 	return result;
+ }
+ 
+-static struct mm_struct *__check_mem_permission(struct task_struct *task)
+-{
+-	struct mm_struct *mm;
+-
+-	mm = get_task_mm(task);
+-	if (!mm)
+-		return ERR_PTR(-EINVAL);
+-
+-	/*
+-	 * A task can always look at itself, in case it chooses
+-	 * to use system calls instead of load instructions.
+-	 */
+-	if (task == current)
+-		return mm;
+-
+-	/*
+-	 * If current is actively ptrace'ing, and would also be
+-	 * permitted to freshly attach with ptrace now, permit it.
+-	 */
+-	if (task_is_stopped_or_traced(task)) {
+-		int match;
+-		rcu_read_lock();
+-		match = (tracehook_tracer_task(task) == current);
+-		rcu_read_unlock();
+-		if (match && ptrace_may_access(task, PTRACE_MODE_ATTACH))
+-			return mm;
+-	}
+-
+-	/*
+-	 * No one else is allowed.
+-	 */
+-	mmput(mm);
+-	return ERR_PTR(-EPERM);
+-}
+-
+-/*
+- * If current may access user memory in @task return a reference to the
+- * corresponding mm, otherwise ERR_PTR.
+- */
+-static struct mm_struct *check_mem_permission(struct task_struct *task)
+-{
+-	struct mm_struct *mm;
+-	int err;
+-
+-	/*
+-	 * Avoid racing if task exec's as we might get a new mm but validate
+-	 * against old credentials.
+-	 */
+-	err = mutex_lock_killable(&task->signal->cred_guard_mutex);
+-	if (err)
+-		return ERR_PTR(err);
+-
+-	mm = __check_mem_permission(task);
+-	mutex_unlock(&task->signal->cred_guard_mutex);
+-
+-	return mm;
+-}
+-
+-struct mm_struct *mm_for_maps(struct task_struct *task)
++static struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
+ {
+ 	struct mm_struct *mm;
+ 	int err;
+@@ -263,7 +205,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+ 
+ 	mm = get_task_mm(task);
+ 	if (mm && mm != current->mm &&
+-			!ptrace_may_access(task, PTRACE_MODE_READ)) {
++			!ptrace_may_access(task, mode)) {
+ 		mmput(mm);
+ 		mm = ERR_PTR(-EACCES);
+ 	}
+@@ -272,6 +214,11 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
+ 	return mm;
+ }
+ 
++struct mm_struct *mm_for_maps(struct task_struct *task)
++{
++	return mm_access(task, PTRACE_MODE_READ);
++}
++
+ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
+ {
+ 	int res = 0;
+@@ -816,38 +763,39 @@ static const struct file_operations proc_single_file_operations = {
+ 
+ static int mem_open(struct inode* inode, struct file* file)
+ {
+-	file->private_data = (void*)((long)current->self_exec_id);
++	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
++	struct mm_struct *mm;
++
++	if (!task)
++		return -ESRCH;
++
++	mm = mm_access(task, PTRACE_MODE_ATTACH);
++	put_task_struct(task);
++
++	if (IS_ERR(mm))
++		return PTR_ERR(mm);
++
+ 	/* OK to pass negative loff_t, we can catch out-of-range */
+ 	file->f_mode |= FMODE_UNSIGNED_OFFSET;
++	file->private_data = mm;
++
+ 	return 0;
+ }
+ 
+ static ssize_t mem_read(struct file * file, char __user * buf,
+ 			size_t count, loff_t *ppos)
+ {
+-	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
++	int ret;
+ 	char *page;
+ 	unsigned long src = *ppos;
+-	int ret = -ESRCH;
+-	struct mm_struct *mm;
++	struct mm_struct *mm = file->private_data;
+ 
+-	if (!task)
+-		goto out_no_task;
++	if (!mm)
++		return 0;
+ 
+-	ret = -ENOMEM;
+ 	page = (char *)__get_free_page(GFP_TEMPORARY);
+ 	if (!page)
+-		goto out;
+-
+-	mm = check_mem_permission(task);
+-	ret = PTR_ERR(mm);
+-	if (IS_ERR(mm))
+-		goto out_free;
+-
+-	ret = -EIO;
+- 
+-	if (file->private_data != (void*)((long)current->self_exec_id))
+-		goto out_put;
++		return -ENOMEM;
+ 
+ 	ret = 0;
+  
+@@ -874,13 +822,7 @@ static ssize_t mem_read(struct file * file, char __user * buf,
+ 	}
+ 	*ppos = src;
+ 
+-out_put:
+-	mmput(mm);
+-out_free:
+ 	free_page((unsigned long) page);
+-out:
+-	put_task_struct(task);
+-out_no_task:
+ 	return ret;
+ }
+ 
+@@ -889,27 +831,15 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+ {
+ 	int copied;
+ 	char *page;
+-	struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+ 	unsigned long dst = *ppos;
+-	struct mm_struct *mm;
++	struct mm_struct *mm = file->private_data;
+ 
+-	copied = -ESRCH;
+-	if (!task)
+-		goto out_no_task;
++	if (!mm)
++		return 0;
+ 
+-	copied = -ENOMEM;
+ 	page = (char *)__get_free_page(GFP_TEMPORARY);
+ 	if (!page)
+-		goto out_task;
+-
+-	mm = check_mem_permission(task);
+-	copied = PTR_ERR(mm);
+-	if (IS_ERR(mm))
+-		goto out_free;
+-
+-	copied = -EIO;
+-	if (file->private_data != (void *)((long)current->self_exec_id))
+-		goto out_mm;
++		return -ENOMEM;
+ 
+ 	copied = 0;
+ 	while (count > 0) {
+@@ -933,13 +863,7 @@ static ssize_t mem_write(struct file * file, const char __user *buf,
+ 	}
+ 	*ppos = dst;
+ 
+-out_mm:
+-	mmput(mm);
+-out_free:
+ 	free_page((unsigned long) page);
+-out_task:
+-	put_task_struct(task);
+-out_no_task:
+ 	return copied;
+ }
+ 
+@@ -959,11 +883,20 @@ loff_t mem_lseek(struct file *file, loff_t offset, int orig)
+ 	return file->f_pos;
+ }
+ 
++static int mem_release(struct inode *inode, struct file *file)
++{
++	struct mm_struct *mm = file->private_data;
++
++	mmput(mm);
++	return 0;
++}
++
+ static const struct file_operations proc_mem_operations = {
+ 	.llseek		= mem_lseek,
+ 	.read		= mem_read,
+ 	.write		= mem_write,
+ 	.open		= mem_open,
++	.release	= mem_release,
+ };
+ 
+ static ssize_t environ_read(struct file *file, char __user *buf,
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index c7d4ee6..3487b06 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -516,6 +516,9 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
+ 		if (!page)
+ 			continue;
+ 
++		if (PageReserved(page))
++			continue;
++
+ 		/* Clear accessed and referenced bits. */
+ 		ptep_test_and_clear_young(vma, addr, pte);
+ 		ClearPageReferenced(page);
+diff --git a/fs/proc/uptime.c b/fs/proc/uptime.c
+index 766b1d4..29166ec 100644
+--- a/fs/proc/uptime.c
++++ b/fs/proc/uptime.c
+@@ -11,15 +11,20 @@ static int uptime_proc_show(struct seq_file *m, void *v)
+ {
+ 	struct timespec uptime;
+ 	struct timespec idle;
++	cputime64_t idletime;
++	u64 nsec;
++	u32 rem;
+ 	int i;
+-	cputime_t idletime = cputime_zero;
+ 
++	idletime = 0;
+ 	for_each_possible_cpu(i)
+ 		idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
+ 
+ 	do_posix_clock_monotonic_gettime(&uptime);
+ 	monotonic_to_bootbased(&uptime);
+-	cputime_to_timespec(idletime, &idle);
++	nsec = cputime64_to_jiffies64(idletime) * TICK_NSEC;
++	idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
++	idle.tv_nsec = rem;
+ 	seq_printf(m, "%lu.%02lu %lu.%02lu\n",
+ 			(unsigned long) uptime.tv_sec,
+ 			(uptime.tv_nsec / (NSEC_PER_SEC / 100)),
+diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
+index a811ac4..fd75b63 100644
+--- a/fs/ubifs/debug.h
++++ b/fs/ubifs/debug.h
+@@ -121,20 +121,21 @@ const char *dbg_key_str1(const struct ubifs_info *c,
+ 			 const union ubifs_key *key);
+ 
+ /*
+- * DBGKEY macros require @dbg_lock to be held, which it is in the dbg message
+- * macros.
++ * TODO: these macros are now broken because there is no locking around them
++ * and we use a global buffer for the key string. This means that in case of
++ * concurrent execution we will end up with incorrect and messy key strings.
+  */
+ #define DBGKEY(key) dbg_key_str0(c, (key))
+ #define DBGKEY1(key) dbg_key_str1(c, (key))
+ 
+-#define ubifs_dbg_msg(type, fmt, ...) do {                        \
+-	spin_lock(&dbg_lock);                                     \
+-	pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__); \
+-	spin_unlock(&dbg_lock);                                   \
+-} while (0)
++#define ubifs_dbg_msg(type, fmt, ...) \
++	pr_debug("UBIFS DBG " type ": " fmt "\n", ##__VA_ARGS__)
+ 
+ /* Just a debugging messages not related to any specific UBIFS subsystem */
+-#define dbg_msg(fmt, ...)   ubifs_dbg_msg("msg", fmt, ##__VA_ARGS__)
++#define dbg_msg(fmt, ...)                                                     \
++	printk(KERN_DEBUG "UBIFS DBG (pid %d): %s: " fmt "\n", current->pid,  \
++	       __func__, ##__VA_ARGS__)
++
+ /* General messages */
+ #define dbg_gen(fmt, ...)   ubifs_dbg_msg("gen", fmt, ##__VA_ARGS__)
+ /* Additional journal messages */
+diff --git a/include/acpi/acpi_numa.h b/include/acpi/acpi_numa.h
+index 1739726..451823c 100644
+--- a/include/acpi/acpi_numa.h
++++ b/include/acpi/acpi_numa.h
+@@ -15,6 +15,7 @@ extern int pxm_to_node(int);
+ extern int node_to_pxm(int);
+ extern void __acpi_map_pxm_to_node(int, int);
+ extern int acpi_map_pxm_to_node(int);
++extern unsigned char acpi_srat_revision;
+ 
+ #endif				/* CONFIG_ACPI_NUMA */
+ #endif				/* __ACP_NUMA_H */
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index cd93f99..1b13021 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -670,6 +670,9 @@ extern int blk_insert_cloned_request(struct request_queue *q,
+ 				     struct request *rq);
+ extern void blk_delay_queue(struct request_queue *, unsigned long);
+ extern void blk_recount_segments(struct request_queue *, struct bio *);
++extern int scsi_verify_blk_ioctl(struct block_device *, unsigned int);
++extern int scsi_cmd_blk_ioctl(struct block_device *, fmode_t,
++			      unsigned int, void __user *);
+ extern int scsi_cmd_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+ 			  unsigned int, void __user *);
+ extern int sg_scsi_ioctl(struct request_queue *, struct gendisk *, fmode_t,
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 8f848e4..f13bb6d 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -207,6 +207,7 @@ struct dentry_operations {
+ 
+ #define DCACHE_CANT_MOUNT	0x0100
+ #define DCACHE_GENOCIDE		0x0200
++#define DCACHE_SHRINK_LIST	0x0400
+ 
+ #define DCACHE_OP_HASH		0x1000
+ #define DCACHE_OP_COMPARE	0x2000
+diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
+index 50940da..313a00e 100644
+--- a/include/linux/memcontrol.h
++++ b/include/linux/memcontrol.h
+@@ -119,6 +119,8 @@ struct zone_reclaim_stat*
+ mem_cgroup_get_reclaim_stat_from_page(struct page *page);
+ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
+ 					struct task_struct *p);
++extern void mem_cgroup_replace_page_cache(struct page *oldpage,
++					struct page *newpage);
+ 
+ #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
+ extern int do_swap_account;
+@@ -370,6 +372,10 @@ static inline
+ void mem_cgroup_count_vm_event(struct mm_struct *mm, enum vm_event_item idx)
+ {
+ }
++static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
++				struct page *newpage)
++{
++}
+ #endif /* CONFIG_CGROUP_MEM_CONT */
+ 
+ #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
+diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
+index e884096..dad7d9a 100644
+--- a/include/linux/pci_regs.h
++++ b/include/linux/pci_regs.h
+@@ -392,7 +392,7 @@
+ #define  PCI_EXP_TYPE_DOWNSTREAM 0x6	/* Downstream Port */
+ #define  PCI_EXP_TYPE_PCI_BRIDGE 0x7	/* PCI/PCI-X Bridge */
+ #define  PCI_EXP_TYPE_RC_END	0x9	/* Root Complex Integrated Endpoint */
+-#define  PCI_EXP_TYPE_RC_EC	0x10	/* Root Complex Event Collector */
++#define  PCI_EXP_TYPE_RC_EC	0xa	/* Root Complex Event Collector */
+ #define PCI_EXP_FLAGS_SLOT	0x0100	/* Slot implemented */
+ #define PCI_EXP_FLAGS_IRQ	0x3e00	/* Interrupt message number */
+ #define PCI_EXP_DEVCAP		4	/* Device capabilities */
+diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
+index 85c50b4..c84e974 100644
+--- a/include/linux/sunrpc/svcsock.h
++++ b/include/linux/sunrpc/svcsock.h
+@@ -34,7 +34,7 @@ struct svc_sock {
+ /*
+  * Function prototypes.
+  */
+-void		svc_close_all(struct list_head *);
++void		svc_close_all(struct svc_serv *);
+ int		svc_recv(struct svc_rqst *, long);
+ int		svc_send(struct svc_rqst *);
+ void		svc_drop(struct svc_rqst *);
+diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
+index 8a4c309..eeeda13 100644
+--- a/include/linux/videodev2.h
++++ b/include/linux/videodev2.h
+@@ -1075,6 +1075,7 @@ struct v4l2_querymenu {
+ #define V4L2_CTRL_FLAG_NEXT_CTRL	0x80000000
+ 
+ /*  User-class control IDs defined by V4L2 */
++#define V4L2_CID_MAX_CTRLS		1024
+ #define V4L2_CID_BASE			(V4L2_CTRL_CLASS_USER | 0x900)
+ #define V4L2_CID_USER_BASE 		V4L2_CID_BASE
+ /*  IDs reserved for driver specific controls */
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 561ac99..0fe6679 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -36,6 +36,7 @@
+ #define TRANSPORT_SENSE_BUFFER			SCSI_SENSE_BUFFERSIZE
+ /* Used by transport_send_check_condition_and_sense() */
+ #define SPC_SENSE_KEY_OFFSET			2
++#define SPC_ADD_SENSE_LEN_OFFSET		7
+ #define SPC_ASC_KEY_OFFSET			12
+ #define SPC_ASCQ_KEY_OFFSET			13
+ #define TRANSPORT_IQN_LEN			224
+diff --git a/include/xen/interface/io/xs_wire.h b/include/xen/interface/io/xs_wire.h
+index 99fcffb..454ee26 100644
+--- a/include/xen/interface/io/xs_wire.h
++++ b/include/xen/interface/io/xs_wire.h
+@@ -84,4 +84,7 @@ struct xenstore_domain_interface {
+     XENSTORE_RING_IDX rsp_cons, rsp_prod;
+ };
+ 
++/* Violating this is very bad.  See docs/misc/xenstore.txt. */
++#define XENSTORE_PAYLOAD_MAX 4096
++
+ #endif /* _XS_WIRE_H */
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index c0851a8..ef6478f 100644
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -360,15 +360,42 @@ out:
+ }
+  
+ #ifdef CONFIG_ROOT_NFS
++
++#define NFSROOT_TIMEOUT_MIN	5
++#define NFSROOT_TIMEOUT_MAX	30
++#define NFSROOT_RETRY_MAX	5
++
+ static int __init mount_nfs_root(void)
+ {
+ 	char *root_dev, *root_data;
++	unsigned int timeout;
++	int try, err;
+ 
+-	if (nfs_root_data(&root_dev, &root_data) != 0)
+-		return 0;
+-	if (do_mount_root(root_dev, "nfs", root_mountflags, root_data) != 0)
++	err = nfs_root_data(&root_dev, &root_data);
++	if (err != 0)
+ 		return 0;
+-	return 1;
++
++	/*
++	 * The server or network may not be ready, so try several
++	 * times.  Stop after a few tries in case the client wants
++	 * to fall back to other boot methods.
++	 */
++	timeout = NFSROOT_TIMEOUT_MIN;
++	for (try = 1; ; try++) {
++		err = do_mount_root(root_dev, "nfs",
++					root_mountflags, root_data);
++		if (err == 0)
++			return 1;
++		if (try > NFSROOT_RETRY_MAX)
++			break;
++
++		/* Wait, in case the server refused us immediately */
++		ssleep(timeout);
++		timeout <<= 1;
++		if (timeout > NFSROOT_TIMEOUT_MAX)
++			timeout = NFSROOT_TIMEOUT_MAX;
++	}
++	return 0;
+ }
+ #endif
+ 
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 7798181..e0f0bdd 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1077,6 +1077,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
+ 		/* Early boot.  kretprobe_table_locks not yet initialized. */
+ 		return;
+ 
++	INIT_HLIST_HEAD(&empty_rp);
+ 	hash = hash_ptr(tk, KPROBE_HASH_BITS);
+ 	head = &kretprobe_inst_table[hash];
+ 	kretprobe_table_lock(hash, &flags);
+@@ -1085,7 +1086,6 @@ void __kprobes kprobe_flush_task(struct task_struct *tk)
+ 			recycle_rp_inst(ri, &empty_rp);
+ 	}
+ 	kretprobe_table_unlock(hash, &flags);
+-	INIT_HLIST_HEAD(&empty_rp);
+ 	hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+ 		hlist_del(&ri->hlist);
+ 		kfree(ri);
+diff --git a/mm/filemap.c b/mm/filemap.c
+index dd828ea..3c981ba 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -396,24 +396,11 @@ EXPORT_SYMBOL(filemap_write_and_wait_range);
+ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ {
+ 	int error;
+-	struct mem_cgroup *memcg = NULL;
+ 
+ 	VM_BUG_ON(!PageLocked(old));
+ 	VM_BUG_ON(!PageLocked(new));
+ 	VM_BUG_ON(new->mapping);
+ 
+-	/*
+-	 * This is not page migration, but prepare_migration and
+-	 * end_migration does enough work for charge replacement.
+-	 *
+-	 * In the longer term we probably want a specialized function
+-	 * for moving the charge from old to new in a more efficient
+-	 * manner.
+-	 */
+-	error = mem_cgroup_prepare_migration(old, new, &memcg, gfp_mask);
+-	if (error)
+-		return error;
+-
+ 	error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
+ 	if (!error) {
+ 		struct address_space *mapping = old->mapping;
+@@ -435,13 +422,12 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
+ 		if (PageSwapBacked(new))
+ 			__inc_zone_page_state(new, NR_SHMEM);
+ 		spin_unlock_irq(&mapping->tree_lock);
++		/* mem_cgroup codes must not be called under tree_lock */
++		mem_cgroup_replace_page_cache(old, new);
+ 		radix_tree_preload_end();
+ 		if (freepage)
+ 			freepage(old);
+ 		page_cache_release(old);
+-		mem_cgroup_end_migration(memcg, old, new, true);
+-	} else {
+-		mem_cgroup_end_migration(memcg, old, new, false);
+ 	}
+ 
+ 	return error;
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index d99217b..3791581 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3422,6 +3422,50 @@ int mem_cgroup_shmem_charge_fallback(struct page *page,
+ 	return ret;
+ }
+ 
++/*
++ * At replace page cache, newpage is not under any memcg but it's on
++ * LRU. So, this function doesn't touch res_counter but handles LRU
++ * in correct way. Both pages are locked so we cannot race with uncharge.
++ */
++void mem_cgroup_replace_page_cache(struct page *oldpage,
++				  struct page *newpage)
++{
++	struct mem_cgroup *memcg;
++	struct page_cgroup *pc;
++	struct zone *zone;
++	enum charge_type type = MEM_CGROUP_CHARGE_TYPE_CACHE;
++	unsigned long flags;
++
++	if (mem_cgroup_disabled())
++		return;
++
++	pc = lookup_page_cgroup(oldpage);
++	/* fix accounting on old pages */
++	lock_page_cgroup(pc);
++	memcg = pc->mem_cgroup;
++	mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), -1);
++	ClearPageCgroupUsed(pc);
++	unlock_page_cgroup(pc);
++
++	if (PageSwapBacked(oldpage))
++		type = MEM_CGROUP_CHARGE_TYPE_SHMEM;
++
++	zone = page_zone(newpage);
++	pc = lookup_page_cgroup(newpage);
++	/*
++	 * Even if newpage->mapping was NULL before starting replacement,
++	 * the newpage may be on LRU(or pagevec for LRU) already. We lock
++	 * LRU while we overwrite pc->mem_cgroup.
++	 */
++	spin_lock_irqsave(&zone->lru_lock, flags);
++	if (PageLRU(newpage))
++		del_page_from_lru_list(zone, newpage, page_lru(newpage));
++	__mem_cgroup_commit_charge(memcg, newpage, 1, pc, type);
++	if (PageLRU(newpage))
++		add_page_to_lru_list(zone, newpage, page_lru(newpage));
++	spin_unlock_irqrestore(&zone->lru_lock, flags);
++}
++
+ #ifdef CONFIG_DEBUG_VM
+ static struct page_cgroup *lookup_page_cgroup_used(struct page *page)
+ {
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 8439d2a..947a7e9 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5565,6 +5565,17 @@ __count_immobile_pages(struct zone *zone, struct page *page, int count)
+ bool is_pageblock_removable_nolock(struct page *page)
+ {
+ 	struct zone *zone = page_zone(page);
++	unsigned long pfn = page_to_pfn(page);
++
++	/*
++	 * We have to be careful here because we are iterating over memory
++	 * sections which are not zone aware so we might end up outside of
++	 * the zone but still within the section.
++	 */
++	if (!zone || zone->zone_start_pfn > pfn ||
++			zone->zone_start_pfn + zone->spanned_pages <= pfn)
++		return false;
++
+ 	return __count_immobile_pages(zone, page, 0);
+ }
+ 
+diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
+index c1f4154..c7056b2 100644
+--- a/net/ipv4/ah4.c
++++ b/net/ipv4/ah4.c
+@@ -136,8 +136,6 @@ static void ah_output_done(struct crypto_async_request *base, int err)
+ 		memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+ 	}
+ 
+-	err = ah->nexthdr;
+-
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb, err);
+ }
+@@ -264,12 +262,12 @@ static void ah_input_done(struct crypto_async_request *base, int err)
+ 	if (err)
+ 		goto out;
+ 
++	err = ah->nexthdr;
++
+ 	skb->network_header += ah_hlen;
+ 	memcpy(skb_network_header(skb), work_iph, ihl);
+ 	__skb_pull(skb, ah_hlen + ihl);
+ 	skb_set_transport_header(skb, -ihl);
+-
+-	err = ah->nexthdr;
+ out:
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_input_resume(skb, err);
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 2195ae6..7a33aaa 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -324,8 +324,6 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
+ #endif
+ 	}
+ 
+-	err = ah->nexthdr;
+-
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb, err);
+ }
+@@ -466,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
+ 	if (err)
+ 		goto out;
+ 
++	err = ah->nexthdr;
++
+ 	skb->network_header += ah_hlen;
+ 	memcpy(skb_network_header(skb), work_iph, hdr_len);
+ 	__skb_pull(skb, ah_hlen + hdr_len);
+ 	skb_set_transport_header(skb, -hdr_len);
+-
+-	err = ah->nexthdr;
+ out:
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_input_resume(skb, err);
+diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
+index 8f6a302..aa1c40a 100644
+--- a/net/mac80211/wpa.c
++++ b/net/mac80211/wpa.c
+@@ -109,7 +109,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
+ 		if (status->flag & RX_FLAG_MMIC_ERROR)
+ 			goto mic_fail;
+ 
+-		if (!(status->flag & RX_FLAG_IV_STRIPPED))
++		if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key)
+ 			goto update_iv;
+ 
+ 		return RX_CONTINUE;
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 2b90292..ce5f111 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -167,6 +167,7 @@ svc_pool_map_alloc_arrays(struct svc_pool_map *m, unsigned int maxpools)
+ 
+ fail_free:
+ 	kfree(m->to_pool);
++	m->to_pool = NULL;
+ fail:
+ 	return -ENOMEM;
+ }
+@@ -287,7 +288,9 @@ svc_pool_map_put(void)
+ 	if (!--m->count) {
+ 		m->mode = SVC_POOL_DEFAULT;
+ 		kfree(m->to_pool);
++		m->to_pool = NULL;
+ 		kfree(m->pool_to);
++		m->pool_to = NULL;
+ 		m->npools = 0;
+ 	}
+ 
+@@ -472,17 +475,20 @@ svc_destroy(struct svc_serv *serv)
+ 		printk("svc_destroy: no threads for serv=%p!\n", serv);
+ 
+ 	del_timer_sync(&serv->sv_temptimer);
+-
+-	svc_close_all(&serv->sv_tempsocks);
++	/*
++	 * The set of xprts (contained in the sv_tempsocks and
++	 * sv_permsocks lists) is now constant, since it is modified
++	 * only by accepting new sockets (done by service threads in
++	 * svc_recv) or aging old ones (done by sv_temptimer), or
++	 * configuration changes (excluded by whatever locking the
++	 * caller is using--nfsd_mutex in the case of nfsd).  So it's
++	 * safe to traverse those lists and shut everything down:
++	 */
++	svc_close_all(serv);
+ 
+ 	if (serv->sv_shutdown)
+ 		serv->sv_shutdown(serv);
+ 
+-	svc_close_all(&serv->sv_permsocks);
+-
+-	BUG_ON(!list_empty(&serv->sv_permsocks));
+-	BUG_ON(!list_empty(&serv->sv_tempsocks));
+-
+ 	cache_clean_deferred(serv);
+ 
+ 	if (svc_serv_is_pooled(serv))
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index bd31208..9d7ed0b 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -901,14 +901,7 @@ void svc_delete_xprt(struct svc_xprt *xprt)
+ 	spin_lock_bh(&serv->sv_lock);
+ 	if (!test_and_set_bit(XPT_DETACHED, &xprt->xpt_flags))
+ 		list_del_init(&xprt->xpt_list);
+-	/*
+-	 * The only time we're called while xpt_ready is still on a list
+-	 * is while the list itself is about to be destroyed (in
+-	 * svc_destroy).  BUT svc_xprt_enqueue could still be attempting
+-	 * to add new entries to the sp_sockets list, so we can't leave
+-	 * a freed xprt on it.
+-	 */
+-	list_del_init(&xprt->xpt_ready);
++	BUG_ON(!list_empty(&xprt->xpt_ready));
+ 	if (test_bit(XPT_TEMP, &xprt->xpt_flags))
+ 		serv->sv_tmpcnt--;
+ 	spin_unlock_bh(&serv->sv_lock);
+@@ -936,22 +929,48 @@ void svc_close_xprt(struct svc_xprt *xprt)
+ }
+ EXPORT_SYMBOL_GPL(svc_close_xprt);
+ 
+-void svc_close_all(struct list_head *xprt_list)
++static void svc_close_list(struct list_head *xprt_list)
++{
++	struct svc_xprt *xprt;
++
++	list_for_each_entry(xprt, xprt_list, xpt_list) {
++		set_bit(XPT_CLOSE, &xprt->xpt_flags);
++		set_bit(XPT_BUSY, &xprt->xpt_flags);
++	}
++}
++
++void svc_close_all(struct svc_serv *serv)
+ {
++	struct svc_pool *pool;
+ 	struct svc_xprt *xprt;
+ 	struct svc_xprt *tmp;
++	int i;
++
++	svc_close_list(&serv->sv_tempsocks);
++	svc_close_list(&serv->sv_permsocks);
+ 
++	for (i = 0; i < serv->sv_nrpools; i++) {
++		pool = &serv->sv_pools[i];
++
++		spin_lock_bh(&pool->sp_lock);
++		while (!list_empty(&pool->sp_sockets)) {
++			xprt = list_first_entry(&pool->sp_sockets, struct svc_xprt, xpt_ready);
++			list_del_init(&xprt->xpt_ready);
++		}
++		spin_unlock_bh(&pool->sp_lock);
++	}
+ 	/*
+-	 * The server is shutting down, and no more threads are running.
+-	 * svc_xprt_enqueue() might still be running, but at worst it
+-	 * will re-add the xprt to sp_sockets, which will soon get
+-	 * freed.  So we don't bother with any more locking, and don't
+-	 * leave the close to the (nonexistent) server threads:
++	 * At this point the sp_sockets lists will stay empty, since
++	 * svc_enqueue will not add new entries without taking the
++	 * sp_lock and checking XPT_BUSY.
+ 	 */
+-	list_for_each_entry_safe(xprt, tmp, xprt_list, xpt_list) {
+-		set_bit(XPT_CLOSE, &xprt->xpt_flags);
++	list_for_each_entry_safe(xprt, tmp, &serv->sv_tempsocks, xpt_list)
+ 		svc_delete_xprt(xprt);
+-	}
++	list_for_each_entry_safe(xprt, tmp, &serv->sv_permsocks, xpt_list)
++		svc_delete_xprt(xprt);
++
++	BUG_ON(!list_empty(&serv->sv_permsocks));
++	BUG_ON(!list_empty(&serv->sv_tempsocks));
+ }
+ 
+ /*
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index a4fe923..25f1e71 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -242,33 +242,61 @@ if ($kconfig) {
+     read_kconfig($kconfig);
+ }
+ 
++sub convert_vars {
++    my ($line, %vars) = @_;
++
++    my $process = "";
++
++    while ($line =~ s/^(.*?)(\$\((.*?)\))//) {
++	my $start = $1;
++	my $variable = $2;
++	my $var = $3;
++
++	if (defined($vars{$var})) {
++	    $process .= $start . $vars{$var};
++	} else {
++	    $process .= $start . $variable;
++	}
++    }
++
++    $process .= $line;
++
++    return $process;
++}
++
+ # Read all Makefiles to map the configs to the objects
+ foreach my $makefile (@makefiles) {
+ 
+-    my $cont = 0;
++    my $line = "";
++    my %make_vars;
+ 
+     open(MIN,$makefile) || die "Can't open $makefile";
+     while (<MIN>) {
++	# if this line ends with a backslash, continue
++	chomp;
++	if (/^(.*)\\$/) {
++	    $line .= $1;
++	    next;
++	}
++
++	$line .= $_;
++	$_ = $line;
++	$line = "";
++
+ 	my $objs;
+ 
+-	# is this a line after a line with a backslash?
+-	if ($cont && /(\S.*)$/) {
+-	    $objs = $1;
+-	}
+-	$cont = 0;
++	$_ = convert_vars($_, %make_vars);
+ 
+ 	# collect objects after obj-$(CONFIG_FOO_BAR)
+ 	if (/obj-\$\((CONFIG_[^\)]*)\)\s*[+:]?=\s*(.*)/) {
+ 	    $var = $1;
+ 	    $objs = $2;
++
++	# check if variables are set
++	} elsif (/^\s*(\S+)\s*[:]?=\s*(.*\S)/) {
++	    $make_vars{$1} = $2;
+ 	}
+ 	if (defined($objs)) {
+-	    # test if the line ends with a backslash
+-	    if ($objs =~ m,(.*)\\$,) {
+-		$objs = $1;
+-		$cont = 1;
+-	    }
+-
+ 	    foreach my $obj (split /\s+/,$objs) {
+ 		$obj =~ s/-/_/g;
+ 		if ($obj =~ /(.*)\.o$/) {
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index f40a6af6..54e35c1 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -462,7 +462,7 @@ __has_rel_mcount(Elf_Shdr const *const relhdr,  /* is SHT_REL or SHT_RELA */
+ 		succeed_file();
+ 	}
+ 	if (w(txthdr->sh_type) != SHT_PROGBITS ||
+-	    !(w(txthdr->sh_flags) & SHF_EXECINSTR))
++	    !(_w(txthdr->sh_flags) & SHF_EXECINSTR))
+ 		return NULL;
+ 	return txtname;
+ }
+diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
+index da36d2c..5335605 100644
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -177,8 +177,8 @@ void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
+ 	strncpy(entry->template.file_name, filename, IMA_EVENT_NAME_LEN_MAX);
+ 
+ 	result = ima_store_template(entry, violation, inode);
+-	if (!result)
++	if (!result || result == -EEXIST)
+ 		iint->flags |= IMA_MEASURED;
+-	else
++	if (result < 0)
+ 		kfree(entry);
+ }
+diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
+index 8e28f04..55a6271 100644
+--- a/security/integrity/ima/ima_queue.c
++++ b/security/integrity/ima/ima_queue.c
+@@ -23,6 +23,8 @@
+ #include <linux/slab.h>
+ #include "ima.h"
+ 
++#define AUDIT_CAUSE_LEN_MAX 32
++
+ LIST_HEAD(ima_measurements);	/* list of all measurements */
+ 
+ /* key: inode (before secure-hashing a file) */
+@@ -94,7 +96,8 @@ static int ima_pcr_extend(const u8 *hash)
+ 
+ 	result = tpm_pcr_extend(TPM_ANY_NUM, CONFIG_IMA_MEASURE_PCR_IDX, hash);
+ 	if (result != 0)
+-		pr_err("IMA: Error Communicating to TPM chip\n");
++		pr_err("IMA: Error Communicating to TPM chip, result: %d\n",
++		       result);
+ 	return result;
+ }
+ 
+@@ -106,14 +109,16 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ {
+ 	u8 digest[IMA_DIGEST_SIZE];
+ 	const char *audit_cause = "hash_added";
++	char tpm_audit_cause[AUDIT_CAUSE_LEN_MAX];
+ 	int audit_info = 1;
+-	int result = 0;
++	int result = 0, tpmresult = 0;
+ 
+ 	mutex_lock(&ima_extend_list_mutex);
+ 	if (!violation) {
+ 		memcpy(digest, entry->digest, sizeof digest);
+ 		if (ima_lookup_digest_entry(digest)) {
+ 			audit_cause = "hash_exists";
++			result = -EEXIST;
+ 			goto out;
+ 		}
+ 	}
+@@ -128,9 +133,11 @@ int ima_add_template_entry(struct ima_template_entry *entry, int violation,
+ 	if (violation)		/* invalidate pcr */
+ 		memset(digest, 0xff, sizeof digest);
+ 
+-	result = ima_pcr_extend(digest);
+-	if (result != 0) {
+-		audit_cause = "TPM error";
++	tpmresult = ima_pcr_extend(digest);
++	if (tpmresult != 0) {
++		snprintf(tpm_audit_cause, AUDIT_CAUSE_LEN_MAX, "TPM_error(%d)",
++			 tpmresult);
++		audit_cause = tpm_audit_cause;
+ 		audit_info = 0;
+ 	}
+ out:
+diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
+index 08ec073..e289a13 100644
+--- a/sound/pci/hda/hda_local.h
++++ b/sound/pci/hda/hda_local.h
+@@ -474,7 +474,12 @@ static inline u32 get_wcaps(struct hda_codec *codec, hda_nid_t nid)
+ }
+ 
+ /* get the widget type from widget capability bits */
+-#define get_wcaps_type(wcaps) (((wcaps) & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT)
++static inline int get_wcaps_type(unsigned int wcaps)
++{
++	if (!wcaps)
++		return -1; /* invalid type */
++	return (wcaps & AC_WCAP_TYPE) >> AC_WCAP_TYPE_SHIFT;
++}
+ 
+ static inline unsigned int get_wcaps_channels(u32 wcaps)
+ {
+diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
+index bfe74c2..6fe944a 100644
+--- a/sound/pci/hda/hda_proc.c
++++ b/sound/pci/hda/hda_proc.c
+@@ -54,6 +54,8 @@ static const char *get_wid_type_name(unsigned int wid_value)
+ 		[AC_WID_BEEP] = "Beep Generator Widget",
+ 		[AC_WID_VENDOR] = "Vendor Defined Widget",
+ 	};
++	if (wid_value == -1)
++		return "UNKNOWN Widget";
+ 	wid_value &= 0xf;
+ 	if (names[wid_value])
+ 		return names[wid_value];
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 5d2e97a..0d8db75 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1602,7 +1602,7 @@ static const struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
+ 				"Dell Studio 1557", STAC_DELL_M6_DMIC),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
+-				"Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
++				"Dell Studio XPS 1645", STAC_DELL_M6_DMIC),
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
+ 				"Dell Studio 1558", STAC_DELL_M6_DMIC),
+ 	{} /* terminator */
+diff --git a/sound/pci/ice1712/amp.c b/sound/pci/ice1712/amp.c
+index e328cfb..e525da2 100644
+--- a/sound/pci/ice1712/amp.c
++++ b/sound/pci/ice1712/amp.c
+@@ -68,8 +68,11 @@ static int __devinit snd_vt1724_amp_init(struct snd_ice1712 *ice)
+ 
+ static int __devinit snd_vt1724_amp_add_controls(struct snd_ice1712 *ice)
+ {
+-	/* we use pins 39 and 41 of the VT1616 for left and right read outputs */
+-	snd_ac97_write_cache(ice->ac97, 0x5a, snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
++	if (ice->ac97)
++		/* we use pins 39 and 41 of the VT1616 for left and right
++		read outputs */
++		snd_ac97_write_cache(ice->ac97, 0x5a,
++			snd_ac97_read(ice->ac97, 0x5a) & ~0x8000);
+ 	return 0;
+ }
+ 
+diff --git a/sound/pci/oxygen/xonar_wm87x6.c b/sound/pci/oxygen/xonar_wm87x6.c
+index 42d1ab1..915546a 100644
+--- a/sound/pci/oxygen/xonar_wm87x6.c
++++ b/sound/pci/oxygen/xonar_wm87x6.c
+@@ -177,6 +177,7 @@ static void wm8776_registers_init(struct oxygen *chip)
+ 	struct xonar_wm87x6 *data = chip->model_data;
+ 
+ 	wm8776_write(chip, WM8776_RESET, 0);
++	wm8776_write(chip, WM8776_PHASESWAP, WM8776_PH_MASK);
+ 	wm8776_write(chip, WM8776_DACCTRL1, WM8776_DZCEN |
+ 		     WM8776_PL_LEFT_LEFT | WM8776_PL_RIGHT_RIGHT);
+ 	wm8776_write(chip, WM8776_DACMUTE, chip->dac_mute ? WM8776_DMUTE : 0);
+diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
+index c400ade..1e7a47a 100644
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -674,7 +674,7 @@ dotry:
+ 		inurb->transfer_buffer_length =
+ 			inurb->number_of_packets *
+ 			inurb->iso_frame_desc[0].length;
+-		preempt_disable();
++
+ 		if (u == 0) {
+ 			int now;
+ 			struct usb_device *dev = inurb->dev;
+@@ -686,19 +686,17 @@ dotry:
+ 		}
+ 		err = usb_submit_urb(inurb, GFP_ATOMIC);
+ 		if (err < 0) {
+-			preempt_enable();
+ 			snd_printk(KERN_ERR"usb_submit_urb(sk->inurb[%i])"
+ 				   " returned %i\n", u, err);
+ 			return err;
+ 		}
+ 		err = usb_submit_urb(outurb, GFP_ATOMIC);
+ 		if (err < 0) {
+-			preempt_enable();
+ 			snd_printk(KERN_ERR"usb_submit_urb(sk->outurb[%i])"
+ 				   " returned %i\n", u, err);
+ 			return err;
+ 		}
+-		preempt_enable();
++
+ 		if (inurb->start_frame != outurb->start_frame) {
+ 			snd_printd(KERN_DEBUG
+ 				   "u[%i] start_frames differ in:%u out:%u\n",

Added: genpatches-2.6/trunk/3.0/1018_linux-3.0.19.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1018_linux-3.0.19.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1018_linux-3.0.19.patch	2012-02-07 14:13:03 UTC (rev 2084)
@@ -0,0 +1,2220 @@
+diff --git a/Makefile b/Makefile
+index 581b8e9..1e57901 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 18
++SUBLEVEL = 19
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
+index 9a9706c..6ebdb0d 100644
+--- a/arch/arm/mach-ux500/Kconfig
++++ b/arch/arm/mach-ux500/Kconfig
+@@ -7,6 +7,7 @@ config UX500_SOC_COMMON
+ 	select HAS_MTU
+ 	select ARM_ERRATA_753970
+ 	select ARM_ERRATA_754322
++	select ARM_ERRATA_764369
+ 
+ menu "Ux500 SoC"
+ 
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index 089c0b5..b6ba103 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -270,10 +270,6 @@ cpu_resume_l1_flags:
+  *	Initialise TLB, Caches, and MMU state ready to switch the MMU
+  *	on.  Return in r0 the new CP15 C1 control register setting.
+  *
+- *	We automatically detect if we have a Harvard cache, and use the
+- *	Harvard cache control instructions insead of the unified cache
+- *	control instructions.
+- *
+  *	This should be able to cover all ARMv7 cores.
+  *
+  *	It is assumed that:
+@@ -363,9 +359,7 @@ __v7_setup:
+ #endif
+ 
+ 3:	mov	r10, #0
+-#ifdef HARVARD_CACHE
+ 	mcr	p15, 0, r10, c7, c5, 0		@ I+BTB cache invalidate
+-#endif
+ 	dsb
+ #ifdef CONFIG_MMU
+ 	mcr	p15, 0, r10, c8, c7, 0		@ invalidate I + D TLBs
+diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
+index 54a13aa..21f7385 100644
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -318,13 +318,13 @@ uv_gpa_in_mmr_space(unsigned long gpa)
+ /* UV global physical address --> socket phys RAM */
+ static inline unsigned long uv_gpa_to_soc_phys_ram(unsigned long gpa)
+ {
+-	unsigned long paddr = gpa & uv_hub_info->gpa_mask;
++	unsigned long paddr;
+ 	unsigned long remap_base = uv_hub_info->lowmem_remap_base;
+ 	unsigned long remap_top =  uv_hub_info->lowmem_remap_top;
+ 
+ 	gpa = ((gpa << uv_hub_info->m_shift) >> uv_hub_info->m_shift) |
+ 		((gpa >> uv_hub_info->n_lshift) << uv_hub_info->m_val);
+-	gpa = gpa & uv_hub_info->gpa_mask;
++	paddr = gpa & uv_hub_info->gpa_mask;
+ 	if (paddr >= remap_base && paddr < remap_base + remap_top)
+ 		paddr -= remap_base;
+ 	return paddr;
+diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
+index c561038..b727450 100644
+--- a/arch/x86/kernel/microcode_amd.c
++++ b/arch/x86/kernel/microcode_amd.c
+@@ -298,13 +298,33 @@ free_table:
+ 	return state;
+ }
+ 
++/*
++ * AMD microcode firmware naming convention, up to family 15h they are in
++ * the legacy file:
++ *
++ *    amd-ucode/microcode_amd.bin
++ *
++ * This legacy file is always smaller than 2K in size.
++ *
++ * Starting at family 15h they are in family specific firmware files:
++ *
++ *    amd-ucode/microcode_amd_fam15h.bin
++ *    amd-ucode/microcode_amd_fam16h.bin
++ *    ...
++ *
++ * These might be larger than 2K.
++ */
+ static enum ucode_state request_microcode_amd(int cpu, struct device *device)
+ {
+-	const char *fw_name = "amd-ucode/microcode_amd.bin";
++	char fw_name[36] = "amd-ucode/microcode_amd.bin";
+ 	const struct firmware *fw;
+ 	enum ucode_state ret = UCODE_NFOUND;
++	struct cpuinfo_x86 *c = &cpu_data(cpu);
++
++	if (c->x86 >= 0x15)
++		snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
+ 
+-	if (request_firmware(&fw, fw_name, device)) {
++	if (request_firmware(&fw, (const char *)fw_name, device)) {
+ 		pr_err("failed to load file %s\n", fw_name);
+ 		goto out;
+ 	}
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 7b65f75..7c1b765 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -151,17 +151,18 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 	cleanup_addr = proglen; /* epilogue address */
+ 
+ 	for (pass = 0; pass < 10; pass++) {
++		u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ 		/* no prologue/epilogue for trivial filters (RET something) */
+ 		proglen = 0;
+ 		prog = temp;
+ 
+-		if (seen) {
++		if (seen_or_pass0) {
+ 			EMIT4(0x55, 0x48, 0x89, 0xe5); /* push %rbp; mov %rsp,%rbp */
+ 			EMIT4(0x48, 0x83, 0xec, 96);	/* subq  $96,%rsp	*/
+ 			/* note : must save %rbx in case bpf_error is hit */
+-			if (seen & (SEEN_XREG | SEEN_DATAREF))
++			if (seen_or_pass0 & (SEEN_XREG | SEEN_DATAREF))
+ 				EMIT4(0x48, 0x89, 0x5d, 0xf8); /* mov %rbx, -8(%rbp) */
+-			if (seen & SEEN_XREG)
++			if (seen_or_pass0 & SEEN_XREG)
+ 				CLEAR_X(); /* make sure we dont leek kernel memory */
+ 
+ 			/*
+@@ -170,7 +171,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 			 *  r9 = skb->len - skb->data_len
+ 			 *  r8 = skb->data
+ 			 */
+-			if (seen & SEEN_DATAREF) {
++			if (seen_or_pass0 & SEEN_DATAREF) {
+ 				if (offsetof(struct sk_buff, len) <= 127)
+ 					/* mov    off8(%rdi),%r9d */
+ 					EMIT4(0x44, 0x8b, 0x4f, offsetof(struct sk_buff, len));
+@@ -260,9 +261,14 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 			case BPF_S_ALU_DIV_X: /* A /= X; */
+ 				seen |= SEEN_XREG;
+ 				EMIT2(0x85, 0xdb);	/* test %ebx,%ebx */
+-				if (pc_ret0 != -1)
+-					EMIT_COND_JMP(X86_JE, addrs[pc_ret0] - (addrs[i] - 4));
+-				else {
++				if (pc_ret0 > 0) {
++					/* addrs[pc_ret0 - 1] is start address of target
++					 * (addrs[i] - 4) is the address following this jmp
++					 * ("xor %edx,%edx; div %ebx" being 4 bytes long)
++					 */
++					EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
++								(addrs[i] - 4));
++				} else {
+ 					EMIT_COND_JMP(X86_JNE, 2 + 5);
+ 					CLEAR_A();
+ 					EMIT1_off32(0xe9, cleanup_addr - (addrs[i] - 4)); /* jmp .+off32 */
+@@ -335,12 +341,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 				}
+ 				/* fallinto */
+ 			case BPF_S_RET_A:
+-				if (seen) {
++				if (seen_or_pass0) {
+ 					if (i != flen - 1) {
+ 						EMIT_JMP(cleanup_addr - addrs[i]);
+ 						break;
+ 					}
+-					if (seen & SEEN_XREG)
++					if (seen_or_pass0 & SEEN_XREG)
+ 						EMIT4(0x48, 0x8b, 0x5d, 0xf8);  /* mov  -8(%rbp),%rbx */
+ 					EMIT1(0xc9);		/* leaveq */
+ 				}
+@@ -483,8 +489,9 @@ common_load:			seen |= SEEN_DATAREF;
+ 				goto common_load;
+ 			case BPF_S_LDX_B_MSH:
+ 				if ((int)K < 0) {
+-					if (pc_ret0 != -1) {
+-						EMIT_JMP(addrs[pc_ret0] - addrs[i]);
++					if (pc_ret0 > 0) {
++						/* addrs[pc_ret0 - 1] is the start address */
++						EMIT_JMP(addrs[pc_ret0 - 1] - addrs[i]);
+ 						break;
+ 					}
+ 					CLEAR_A();
+@@ -599,13 +606,14 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+ 		 * use it to give the cleanup instruction(s) addr
+ 		 */
+ 		cleanup_addr = proglen - 1; /* ret */
+-		if (seen)
++		if (seen_or_pass0)
+ 			cleanup_addr -= 1; /* leaveq */
+-		if (seen & SEEN_XREG)
++		if (seen_or_pass0 & SEEN_XREG)
+ 			cleanup_addr -= 4; /* mov  -8(%rbp),%rbx */
+ 
+ 		if (image) {
+-			WARN_ON(proglen != oldproglen);
++			if (proglen != oldproglen)
++				pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n", proglen, oldproglen);
+ 			break;
+ 		}
+ 		if (proglen == oldproglen) {
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 9ed9f60..88f160b 100644
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -21,8 +21,6 @@
+ #include <linux/percpu.h>
+ #include <asm/byteorder.h>
+ 
+-static DEFINE_PER_CPU(u64[80], msg_schedule);
+-
+ static inline u64 Ch(u64 x, u64 y, u64 z)
+ {
+         return z ^ (x & (y ^ z));
+@@ -80,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
+ 
+ static inline void BLEND_OP(int I, u64 *W)
+ {
+-	W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
++	W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
+ }
+ 
+ static void
+@@ -89,38 +87,48 @@ sha512_transform(u64 *state, const u8 *input)
+ 	u64 a, b, c, d, e, f, g, h, t1, t2;
+ 
+ 	int i;
+-	u64 *W = get_cpu_var(msg_schedule);
++	u64 W[16];
+ 
+ 	/* load the input */
+         for (i = 0; i < 16; i++)
+                 LOAD_OP(i, W, input);
+ 
+-        for (i = 16; i < 80; i++) {
+-                BLEND_OP(i, W);
+-        }
+-
+ 	/* load the state into our registers */
+ 	a=state[0];   b=state[1];   c=state[2];   d=state[3];
+ 	e=state[4];   f=state[5];   g=state[6];   h=state[7];
+ 
+-	/* now iterate */
+-	for (i=0; i<80; i+=8) {
+-		t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i  ] + W[i  ];
+-		t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
+-		t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1];
+-		t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
+-		t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2];
+-		t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
+-		t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3];
+-		t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
+-		t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4];
+-		t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
+-		t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5];
+-		t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
+-		t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6];
+-		t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
+-		t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7];
+-		t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
++#define SHA512_0_15(i, a, b, c, d, e, f, g, h)			\
++	t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i];	\
++	t2 = e0(a) + Maj(a, b, c);				\
++	d += t1;						\
++	h = t1 + t2
++
++#define SHA512_16_79(i, a, b, c, d, e, f, g, h)			\
++	BLEND_OP(i, W);						\
++	t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16];	\
++	t2 = e0(a) + Maj(a, b, c);				\
++	d += t1;						\
++	h = t1 + t2
++
++	for (i = 0; i < 16; i += 8) {
++		SHA512_0_15(i, a, b, c, d, e, f, g, h);
++		SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
++		SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
++		SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
++		SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
++		SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
++		SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
++		SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
++	}
++	for (i = 16; i < 80; i += 8) {
++		SHA512_16_79(i, a, b, c, d, e, f, g, h);
++		SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
++		SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
++		SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
++		SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
++		SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
++		SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
++		SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
+ 	}
+ 
+ 	state[0] += a; state[1] += b; state[2] += c; state[3] += d;
+@@ -128,8 +136,6 @@ sha512_transform(u64 *state, const u8 *input)
+ 
+ 	/* erase our data */
+ 	a = b = c = d = e = f = g = h = t1 = t2 = 0;
+-	memset(W, 0, sizeof(__get_cpu_var(msg_schedule)));
+-	put_cpu_var(msg_schedule);
+ }
+ 
+ static int
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index 3f46772..ba23790 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -101,7 +101,7 @@ static int drm_add_magic(struct drm_master *master, struct drm_file *priv,
+  * Searches and unlinks the entry in drm_device::magiclist with the magic
+  * number hash key, while holding the drm_device::struct_mutex lock.
+  */
+-static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
++int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
+ {
+ 	struct drm_magic_entry *pt;
+ 	struct drm_hash_item *hash;
+@@ -136,6 +136,8 @@ static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
+  * If there is a magic number in drm_file::magic then use it, otherwise
+  * searches an unique non-zero magic number and add it associating it with \p
+  * file_priv.
++ * This ioctl needs protection by the drm_global_mutex, which protects
++ * struct drm_file::magic and struct drm_magic_entry::priv.
+  */
+ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ {
+@@ -173,6 +175,8 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
+  * \return zero if authentication successed, or a negative number otherwise.
+  *
+  * Checks if \p file_priv is associated with the magic number passed in \arg.
++ * This ioctl needs protection by the drm_global_mutex, which protects
++ * struct drm_file::magic and struct drm_magic_entry::priv.
+  */
+ int drm_authmagic(struct drm_device *dev, void *data,
+ 		  struct drm_file *file_priv)
+diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
+index 2ec7d48..c42e12c 100644
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -486,6 +486,11 @@ int drm_release(struct inode *inode, struct file *filp)
+ 		  (long)old_encode_dev(file_priv->minor->device),
+ 		  dev->open_count);
+ 
++	/* Release any auth tokens that might point to this file_priv,
++	   (do that under the drm_global_mutex) */
++	if (file_priv->magic)
++		(void) drm_remove_magic(file_priv->master, file_priv->magic);
++
+ 	/* if the master has gone away we can't do anything with the lock */
+ 	if (file_priv->minor->master)
+ 		drm_master_release(dev, filp);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 30fe554..bdda08e 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -1059,15 +1059,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+ 
+ 	/* Set the SDVO control regs. */
+ 	if (INTEL_INFO(dev)->gen >= 4) {
+-		sdvox = 0;
++		/* The real mode polarity is set by the SDVO commands, using
++		 * struct intel_sdvo_dtd. */
++		sdvox = SDVO_VSYNC_ACTIVE_HIGH | SDVO_HSYNC_ACTIVE_HIGH;
+ 		if (intel_sdvo->is_hdmi)
+ 			sdvox |= intel_sdvo->color_range;
+ 		if (INTEL_INFO(dev)->gen < 5)
+ 			sdvox |= SDVO_BORDER_ENABLE;
+-		if (adjusted_mode->flags & DRM_MODE_FLAG_PVSYNC)
+-			sdvox |= SDVO_VSYNC_ACTIVE_HIGH;
+-		if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
+-			sdvox |= SDVO_HSYNC_ACTIVE_HIGH;
+ 	} else {
+ 		sdvox = I915_READ(intel_sdvo->sdvo_reg);
+ 		switch (intel_sdvo->sdvo_reg) {
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index fecc1aa..5feb6e9 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -134,6 +134,12 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
+ 	/* Dell RS690 only seems to work with MSIs. */
+ 	if ((rdev->pdev->device == 0x791f) &&
+ 	    (rdev->pdev->subsystem_vendor == 0x1028) &&
++	    (rdev->pdev->subsystem_device == 0x01fc))
++		return true;
++
++	/* Dell RS690 only seems to work with MSIs. */
++	if ((rdev->pdev->device == 0x791f) &&
++	    (rdev->pdev->subsystem_vendor == 0x1028) &&
+ 	    (rdev->pdev->subsystem_device == 0x01fd))
+ 		return true;
+ 
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index dfe32e6..8a38c91 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -313,7 +313,7 @@ int vmw_framebuffer_create_handle(struct drm_framebuffer *fb,
+ 				  unsigned int *handle)
+ {
+ 	if (handle)
+-		handle = 0;
++		*handle = 0;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
+index 92f9497..6dbfd3e 100644
+--- a/drivers/hwmon/f71805f.c
++++ b/drivers/hwmon/f71805f.c
+@@ -283,11 +283,11 @@ static inline long temp_from_reg(u8 reg)
+ 
+ static inline u8 temp_to_reg(long val)
+ {
+-	if (val < 0)
+-		val = 0;
+-	else if (val > 1000 * 0xff)
+-		val = 0xff;
+-	return ((val + 500) / 1000);
++	if (val <= 0)
++		return 0;
++	if (val >= 1000 * 0xff)
++		return 0xff;
++	return (val + 500) / 1000;
+ }
+ 
+ /*
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index cf4330b..9594cdb 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -883,7 +883,7 @@ static int sht15_invalidate_voltage(struct notifier_block *nb,
+ 
+ static int __devinit sht15_probe(struct platform_device *pdev)
+ {
+-	int ret = 0;
++	int ret;
+ 	struct sht15_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
+ 	u8 status = 0;
+ 
+@@ -901,6 +901,7 @@ static int __devinit sht15_probe(struct platform_device *pdev)
+ 	init_waitqueue_head(&data->wait_queue);
+ 
+ 	if (pdev->dev.platform_data == NULL) {
++		ret = -EINVAL;
+ 		dev_err(&pdev->dev, "no platform data supplied\n");
+ 		goto err_free_data;
+ 	}
+diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
+index 4b2fc50..6284515 100644
+--- a/drivers/hwmon/w83627ehf.c
++++ b/drivers/hwmon/w83627ehf.c
+@@ -1295,6 +1295,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
+ {
+ 	struct w83627ehf_data *data = dev_get_drvdata(dev);
+ 	struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
++	struct w83627ehf_sio_data *sio_data = dev->platform_data;
+ 	int nr = sensor_attr->index;
+ 	unsigned long val;
+ 	int err;
+@@ -1306,6 +1307,11 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
+ 
+ 	if (val > 1)
+ 		return -EINVAL;
++
++	/* On NCT67766F, DC mode is only supported for pwm1 */
++	if (sio_data->kind == nct6776 && nr && val != 1)
++		return -EINVAL;
++
+ 	mutex_lock(&data->update_lock);
+ 	reg = w83627ehf_read_value(data, W83627EHF_REG_PWM_ENABLE[nr]);
+ 	data->pwm_mode[nr] = val;
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index 2df9276..5e725e0 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -871,16 +871,12 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
+ 	}
+ }
+ 
+-/* hw is a boolean parameter that determines whether we should try and
+- * set the hw address of the device as well as the hw address of the
+- * net_device
+- */
+-static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[], int hw)
++static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[])
+ {
+ 	struct net_device *dev = slave->dev;
+ 	struct sockaddr s_addr;
+ 
+-	if (!hw) {
++	if (slave->bond->params.mode == BOND_MODE_TLB) {
+ 		memcpy(dev->dev_addr, addr, dev->addr_len);
+ 		return 0;
+ 	}
+@@ -910,8 +906,8 @@ static void alb_swap_mac_addr(struct bonding *bond, struct slave *slave1, struct
+ 	u8 tmp_mac_addr[ETH_ALEN];
+ 
+ 	memcpy(tmp_mac_addr, slave1->dev->dev_addr, ETH_ALEN);
+-	alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr, bond->alb_info.rlb_enabled);
+-	alb_set_slave_mac_addr(slave2, tmp_mac_addr, bond->alb_info.rlb_enabled);
++	alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr);
++	alb_set_slave_mac_addr(slave2, tmp_mac_addr);
+ 
+ }
+ 
+@@ -1058,8 +1054,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
+ 
+ 		/* Try setting slave mac to bond address and fall-through
+ 		   to code handling that situation below... */
+-		alb_set_slave_mac_addr(slave, bond->dev->dev_addr,
+-				       bond->alb_info.rlb_enabled);
++		alb_set_slave_mac_addr(slave, bond->dev->dev_addr);
+ 	}
+ 
+ 	/* The slave's address is equal to the address of the bond.
+@@ -1095,8 +1090,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
+ 	}
+ 
+ 	if (free_mac_slave) {
+-		alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr,
+-				       bond->alb_info.rlb_enabled);
++		alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr);
+ 
+ 		pr_warning("%s: Warning: the hw address of slave %s is in use by the bond; giving it the hw address of %s\n",
+ 			   bond->dev->name, slave->dev->name,
+@@ -1452,8 +1446,7 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
+ {
+ 	int res;
+ 
+-	res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr,
+-				     bond->alb_info.rlb_enabled);
++	res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr);
+ 	if (res) {
+ 		return res;
+ 	}
+@@ -1604,8 +1597,7 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
+ 		alb_swap_mac_addr(bond, swap_slave, new_slave);
+ 	} else {
+ 		/* set the new_slave to the bond mac address */
+-		alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr,
+-				       bond->alb_info.rlb_enabled);
++		alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr);
+ 	}
+ 
+ 	if (swap_slave) {
+@@ -1665,8 +1657,7 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
+ 		alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
+ 		alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
+ 	} else {
+-		alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
+-				       bond->alb_info.rlb_enabled);
++		alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr);
+ 
+ 		read_lock(&bond->lock);
+ 		alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
+diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
+index f5f6831..4a4733e 100644
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1733,9 +1733,19 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ {
+ 	struct uart_amba_port *uap = amba_ports[co->index];
+ 	unsigned int status, old_cr, new_cr;
++	unsigned long flags;
++	int locked = 1;
+ 
+ 	clk_enable(uap->clk);
+ 
++	local_irq_save(flags);
++	if (uap->port.sysrq)
++		locked = 0;
++	else if (oops_in_progress)
++		locked = spin_trylock(&uap->port.lock);
++	else
++		spin_lock(&uap->port.lock);
++
+ 	/*
+ 	 *	First save the CR then disable the interrupts
+ 	 */
+@@ -1755,6 +1765,10 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
+ 	} while (status & UART01x_FR_BUSY);
+ 	writew(old_cr, uap->port.membase + UART011_CR);
+ 
++	if (locked)
++		spin_unlock(&uap->port.lock);
++	local_irq_restore(flags);
++
+ 	clk_disable(uap->clk);
+ }
+ 
+diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
+index 2aaafa9..6c12d94 100644
+--- a/drivers/tty/serial/jsm/jsm_driver.c
++++ b/drivers/tty/serial/jsm/jsm_driver.c
+@@ -269,6 +269,7 @@ static void jsm_io_resume(struct pci_dev *pdev)
+ 	struct jsm_board *brd = pci_get_drvdata(pdev);
+ 
+ 	pci_restore_state(pdev);
++	pci_save_state(pdev);
+ 
+ 	jsm_uart_port_init(brd);
+ }
+diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
+index 33d37d2..a4aaca0 100644
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -227,7 +227,6 @@ int tty_port_block_til_ready(struct tty_port *port,
+ 	int do_clocal = 0, retval;
+ 	unsigned long flags;
+ 	DEFINE_WAIT(wait);
+-	int cd;
+ 
+ 	/* block if port is in the process of being closed */
+ 	if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING) {
+@@ -284,11 +283,14 @@ int tty_port_block_til_ready(struct tty_port *port,
+ 				retval = -ERESTARTSYS;
+ 			break;
+ 		}
+-		/* Probe the carrier. For devices with no carrier detect this
+-		   will always return true */
+-		cd = tty_port_carrier_raised(port);
++		/*
++		 * Probe the carrier. For devices with no carrier detect
++		 * tty_port_carrier_raised will always return true.
++		 * Never ask drivers if CLOCAL is set, this causes troubles
++		 * on some hardware.
++		 */
+ 		if (!(port->flags & ASYNC_CLOSING) &&
+-				(do_clocal || cd))
++				(do_clocal || tty_port_carrier_raised(port)))
+ 			break;
+ 		if (signal_pending(current)) {
+ 			retval = -ERESTARTSYS;
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 2b9ff51..90581a8 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -57,6 +57,8 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
+ 
+ #define WDM_MAX			16
+ 
++/* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
++#define WDM_DEFAULT_BUFSIZE	256
+ 
+ static DEFINE_MUTEX(wdm_mutex);
+ 
+@@ -88,7 +90,8 @@ struct wdm_device {
+ 	int			count;
+ 	dma_addr_t		shandle;
+ 	dma_addr_t		ihandle;
+-	struct mutex		lock;
++	struct mutex		wlock;
++	struct mutex		rlock;
+ 	wait_queue_head_t	wait;
+ 	struct work_struct	rxwork;
+ 	int			werr;
+@@ -323,7 +326,7 @@ static ssize_t wdm_write
+ 	}
+ 
+ 	/* concurrent writes and disconnect */
+-	r = mutex_lock_interruptible(&desc->lock);
++	r = mutex_lock_interruptible(&desc->wlock);
+ 	rv = -ERESTARTSYS;
+ 	if (r) {
+ 		kfree(buf);
+@@ -386,7 +389,7 @@ static ssize_t wdm_write
+ out:
+ 	usb_autopm_put_interface(desc->intf);
+ outnp:
+-	mutex_unlock(&desc->lock);
++	mutex_unlock(&desc->wlock);
+ outnl:
+ 	return rv < 0 ? rv : count;
+ }
+@@ -399,7 +402,7 @@ static ssize_t wdm_read
+ 	struct wdm_device *desc = file->private_data;
+ 
+ 
+-	rv = mutex_lock_interruptible(&desc->lock); /*concurrent reads */
++	rv = mutex_lock_interruptible(&desc->rlock); /*concurrent reads */
+ 	if (rv < 0)
+ 		return -ERESTARTSYS;
+ 
+@@ -467,14 +470,16 @@ retry:
+ 	for (i = 0; i < desc->length - cntr; i++)
+ 		desc->ubuf[i] = desc->ubuf[i + cntr];
+ 
++	spin_lock_irq(&desc->iuspin);
+ 	desc->length -= cntr;
++	spin_unlock_irq(&desc->iuspin);
+ 	/* in case we had outstanding data */
+ 	if (!desc->length)
+ 		clear_bit(WDM_READ, &desc->flags);
+ 	rv = cntr;
+ 
+ err:
+-	mutex_unlock(&desc->lock);
++	mutex_unlock(&desc->rlock);
+ 	return rv;
+ }
+ 
+@@ -540,7 +545,8 @@ static int wdm_open(struct inode *inode, struct file *file)
+ 	}
+ 	intf->needs_remote_wakeup = 1;
+ 
+-	mutex_lock(&desc->lock);
++	/* using write lock to protect desc->count */
++	mutex_lock(&desc->wlock);
+ 	if (!desc->count++) {
+ 		desc->werr = 0;
+ 		desc->rerr = 0;
+@@ -553,7 +559,7 @@ static int wdm_open(struct inode *inode, struct file *file)
+ 	} else {
+ 		rv = 0;
+ 	}
+-	mutex_unlock(&desc->lock);
++	mutex_unlock(&desc->wlock);
+ 	usb_autopm_put_interface(desc->intf);
+ out:
+ 	mutex_unlock(&wdm_mutex);
+@@ -565,9 +571,11 @@ static int wdm_release(struct inode *inode, struct file *file)
+ 	struct wdm_device *desc = file->private_data;
+ 
+ 	mutex_lock(&wdm_mutex);
+-	mutex_lock(&desc->lock);
++
++	/* using write lock to protect desc->count */
++	mutex_lock(&desc->wlock);
+ 	desc->count--;
+-	mutex_unlock(&desc->lock);
++	mutex_unlock(&desc->wlock);
+ 
+ 	if (!desc->count) {
+ 		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+@@ -630,7 +638,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 	struct usb_cdc_dmm_desc *dmhd;
+ 	u8 *buffer = intf->altsetting->extra;
+ 	int buflen = intf->altsetting->extralen;
+-	u16 maxcom = 0;
++	u16 maxcom = WDM_DEFAULT_BUFSIZE;
+ 
+ 	if (!buffer)
+ 		goto out;
+@@ -665,7 +673,8 @@ next_desc:
+ 	desc = kzalloc(sizeof(struct wdm_device), GFP_KERNEL);
+ 	if (!desc)
+ 		goto out;
+-	mutex_init(&desc->lock);
++	mutex_init(&desc->rlock);
++	mutex_init(&desc->wlock);
+ 	spin_lock_init(&desc->iuspin);
+ 	init_waitqueue_head(&desc->wait);
+ 	desc->wMaxCommand = maxcom;
+@@ -716,7 +725,7 @@ next_desc:
+ 		goto err;
+ 
+ 	desc->inbuf = usb_alloc_coherent(interface_to_usbdev(intf),
+-					 desc->bMaxPacketSize0,
++					 desc->wMaxCommand,
+ 					 GFP_KERNEL,
+ 					 &desc->response->transfer_dma);
+ 	if (!desc->inbuf)
+@@ -779,11 +788,13 @@ static void wdm_disconnect(struct usb_interface *intf)
+ 	/* to terminate pending flushes */
+ 	clear_bit(WDM_IN_USE, &desc->flags);
+ 	spin_unlock_irqrestore(&desc->iuspin, flags);
+-	mutex_lock(&desc->lock);
++	wake_up_all(&desc->wait);
++	mutex_lock(&desc->rlock);
++	mutex_lock(&desc->wlock);
+ 	kill_urbs(desc);
+ 	cancel_work_sync(&desc->rxwork);
+-	mutex_unlock(&desc->lock);
+-	wake_up_all(&desc->wait);
++	mutex_unlock(&desc->wlock);
++	mutex_unlock(&desc->rlock);
+ 	if (!desc->count)
+ 		cleanup(desc);
+ 	mutex_unlock(&wdm_mutex);
+@@ -798,8 +809,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ 	dev_dbg(&desc->intf->dev, "wdm%d_suspend\n", intf->minor);
+ 
+ 	/* if this is an autosuspend the caller does the locking */
+-	if (!(message.event & PM_EVENT_AUTO))
+-		mutex_lock(&desc->lock);
++	if (!(message.event & PM_EVENT_AUTO)) {
++		mutex_lock(&desc->rlock);
++		mutex_lock(&desc->wlock);
++	}
+ 	spin_lock_irq(&desc->iuspin);
+ 
+ 	if ((message.event & PM_EVENT_AUTO) &&
+@@ -815,8 +828,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
+ 		kill_urbs(desc);
+ 		cancel_work_sync(&desc->rxwork);
+ 	}
+-	if (!(message.event & PM_EVENT_AUTO))
+-		mutex_unlock(&desc->lock);
++	if (!(message.event & PM_EVENT_AUTO)) {
++		mutex_unlock(&desc->wlock);
++		mutex_unlock(&desc->rlock);
++	}
+ 
+ 	return rv;
+ }
+@@ -854,7 +869,8 @@ static int wdm_pre_reset(struct usb_interface *intf)
+ {
+ 	struct wdm_device *desc = usb_get_intfdata(intf);
+ 
+-	mutex_lock(&desc->lock);
++	mutex_lock(&desc->rlock);
++	mutex_lock(&desc->wlock);
+ 	kill_urbs(desc);
+ 
+ 	/*
+@@ -876,7 +892,8 @@ static int wdm_post_reset(struct usb_interface *intf)
+ 	int rv;
+ 
+ 	rv = recover_from_urb_loss(desc);
+-	mutex_unlock(&desc->lock);
++	mutex_unlock(&desc->wlock);
++	mutex_unlock(&desc->rlock);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
+index f380bf9..bc7f166 100644
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -125,7 +125,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
+ 	 */
+ 	if (pdata->init && pdata->init(pdev)) {
+ 		retval = -ENODEV;
+-		goto err3;
++		goto err4;
+ 	}
+ 
+ 	/* Enable USB controller, 83xx or 8536 */
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index c0c5d6c..edcedc4 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1218,6 +1218,7 @@ static void handle_vendor_event(struct xhci_hcd *xhci,
+  *
+  * Returns a zero-based port number, which is suitable for indexing into each of
+  * the split roothubs' port arrays and bus state arrays.
++ * Add one to it in order to call xhci_find_slot_id_by_port.
+  */
+ static unsigned int find_faked_portnum_from_hw_portnum(struct usb_hcd *hcd,
+ 		struct xhci_hcd *xhci, u32 port_id)
+@@ -1340,7 +1341,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 			temp |= PORT_LINK_STROBE | XDEV_U0;
+ 			xhci_writel(xhci, temp, port_array[faked_port_index]);
+ 			slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+-					faked_port_index);
++					faked_port_index + 1);
+ 			if (!slot_id) {
+ 				xhci_dbg(xhci, "slot_id is zero\n");
+ 				goto cleanup;
+@@ -3381,7 +3382,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 		/* Check TD length */
+ 		if (running_total != td_len) {
+ 			xhci_err(xhci, "ISOC TD length unmatch\n");
+-			return -EINVAL;
++			ret = -EINVAL;
++			goto cleanup;
+ 		}
+ 	}
+ 
+diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
+index 417b8f2..59689fa 100644
+--- a/drivers/usb/misc/usbsevseg.c
++++ b/drivers/usb/misc/usbsevseg.c
+@@ -24,7 +24,7 @@
+ 
+ #define VENDOR_ID	0x0fc5
+ #define PRODUCT_ID	0x1227
+-#define MAXLEN		6
++#define MAXLEN		8
+ 
+ /* table of devices that work with this driver */
+ static const struct usb_device_id id_table[] = {
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index a1a324b..a515237 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -39,6 +39,8 @@ static void cp210x_get_termios(struct tty_struct *,
+ 	struct usb_serial_port *port);
+ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ 	unsigned int *cflagp, unsigned int *baudp);
++static void cp210x_change_speed(struct tty_struct *, struct usb_serial_port *,
++							struct ktermios *);
+ static void cp210x_set_termios(struct tty_struct *, struct usb_serial_port *,
+ 							struct ktermios*);
+ static int cp210x_tiocmget(struct tty_struct *);
+@@ -138,6 +140,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ 	{ USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
++	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ 	{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+ 	{ } /* Terminating Entry */
+ };
+@@ -201,6 +204,8 @@ static struct usb_serial_driver cp210x_device = {
+ #define CP210X_EMBED_EVENTS	0x15
+ #define CP210X_GET_EVENTSTATE	0x16
+ #define CP210X_SET_CHARS	0x19
++#define CP210X_GET_BAUDRATE	0x1D
++#define CP210X_SET_BAUDRATE	0x1E
+ 
+ /* CP210X_IFC_ENABLE */
+ #define UART_ENABLE		0x0001
+@@ -354,8 +359,8 @@ static inline int cp210x_set_config_single(struct usb_serial_port *port,
+  * Quantises the baud rate as per AN205 Table 1
+  */
+ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+-	if      (baud <= 56)       baud = 0;
+-	else if (baud <= 300)      baud = 300;
++	if (baud <= 300)
++		baud = 300;
+ 	else if (baud <= 600)      baud = 600;
+ 	else if (baud <= 1200)     baud = 1200;
+ 	else if (baud <= 1800)     baud = 1800;
+@@ -383,17 +388,15 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
+ 	else if (baud <= 491520)   baud = 460800;
+ 	else if (baud <= 567138)   baud = 500000;
+ 	else if (baud <= 670254)   baud = 576000;
+-	else if (baud <= 1053257)  baud = 921600;
+-	else if (baud <= 1474560)  baud = 1228800;
+-	else if (baud <= 2457600)  baud = 1843200;
+-	else                       baud = 3686400;
++	else if (baud < 1000000)
++		baud = 921600;
++	else if (baud > 2000000)
++		baud = 2000000;
+ 	return baud;
+ }
+ 
+ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+-	int result;
+-
+ 	dbg("%s - port %d", __func__, port->number);
+ 
+ 	if (cp210x_set_config_single(port, CP210X_IFC_ENABLE, UART_ENABLE)) {
+@@ -402,13 +405,14 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 		return -EPROTO;
+ 	}
+ 
+-	result = usb_serial_generic_open(tty, port);
+-	if (result)
+-		return result;
+-
+ 	/* Configure the termios structure */
+ 	cp210x_get_termios(tty, port);
+-	return 0;
++
++	/* The baud rate must be initialised on cp2104 */
++	if (tty)
++		cp210x_change_speed(tty, port, NULL);
++
++	return usb_serial_generic_open(tty, port);
+ }
+ 
+ static void cp210x_close(struct usb_serial_port *port)
+@@ -460,10 +464,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ 
+ 	dbg("%s - port %d", __func__, port->number);
+ 
+-	cp210x_get_config(port, CP210X_GET_BAUDDIV, &baud, 2);
+-	/* Convert to baudrate */
+-	if (baud)
+-		baud = cp210x_quantise_baudrate((BAUD_RATE_GEN_FREQ + baud/2)/ baud);
++	cp210x_get_config(port, CP210X_GET_BAUDRATE, &baud, 4);
+ 
+ 	dbg("%s - baud rate = %d", __func__, baud);
+ 	*baudp = baud;
+@@ -577,11 +578,64 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
+ 	*cflagp = cflag;
+ }
+ 
++/*
++ * CP2101 supports the following baud rates:
++ *
++ *	300, 600, 1200, 1800, 2400, 4800, 7200, 9600, 14400, 19200, 28800,
++ *	38400, 56000, 57600, 115200, 128000, 230400, 460800, 921600
++ *
++ * CP2102 and CP2103 support the following additional rates:
++ *
++ *	4000, 16000, 51200, 64000, 76800, 153600, 250000, 256000, 500000,
++ *	576000
++ *
++ * The device will map a requested rate to a supported one, but the result
++ * of requests for rates greater than 1053257 is undefined (see AN205).
++ *
++ * CP2104, CP2105 and CP2110 support most rates up to 2M, 921k and 1M baud,
++ * respectively, with an error less than 1%. The actual rates are determined
++ * by
++ *
++ *	div = round(freq / (2 x prescale x request))
++ *	actual = freq / (2 x prescale x div)
++ *
++ * For CP2104 and CP2105 freq is 48Mhz and prescale is 4 for request <= 365bps
++ * or 1 otherwise.
++ * For CP2110 freq is 24Mhz and prescale is 4 for request <= 300bps or 1
++ * otherwise.
++ */
++static void cp210x_change_speed(struct tty_struct *tty,
++		struct usb_serial_port *port, struct ktermios *old_termios)
++{
++	u32 baud;
++
++	baud = tty->termios->c_ospeed;
++
++	/* This maps the requested rate to a rate valid on cp2102 or cp2103,
++	 * or to an arbitrary rate in [1M,2M].
++	 *
++	 * NOTE: B0 is not implemented.
++	 */
++	baud = cp210x_quantise_baudrate(baud);
++
++	dbg("%s - setting baud rate to %u", __func__, baud);
++	if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud,
++							sizeof(baud))) {
++		dev_warn(&port->dev, "failed to set baud rate to %u\n", baud);
++		if (old_termios)
++			baud = old_termios->c_ospeed;
++		else
++			baud = 9600;
++	}
++
++	tty_encode_baud_rate(tty, baud, baud);
++}
++
+ static void cp210x_set_termios(struct tty_struct *tty,
+ 		struct usb_serial_port *port, struct ktermios *old_termios)
+ {
+ 	unsigned int cflag, old_cflag;
+-	unsigned int baud = 0, bits;
++	unsigned int bits;
+ 	unsigned int modem_ctl[4];
+ 
+ 	dbg("%s - port %d", __func__, port->number);
+@@ -592,20 +646,9 @@ static void cp210x_set_termios(struct tty_struct *tty,
+ 	tty->termios->c_cflag &= ~CMSPAR;
+ 	cflag = tty->termios->c_cflag;
+ 	old_cflag = old_termios->c_cflag;
+-	baud = cp210x_quantise_baudrate(tty_get_baud_rate(tty));
+-
+-	/* If the baud rate is to be updated*/
+-	if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
+-		dbg("%s - Setting baud rate to %d baud", __func__,
+-				baud);
+-		if (cp210x_set_config_single(port, CP210X_SET_BAUDDIV,
+-					((BAUD_RATE_GEN_FREQ + baud/2) / baud))) {
+-			dbg("Baud rate requested not supported by device");
+-			baud = tty_termios_baud_rate(old_termios);
+-		}
+-	}
+-	/* Report back the resulting baud rate */
+-	tty_encode_baud_rate(tty, baud, baud);
++
++	if (tty->termios->c_ospeed != old_termios->c_ospeed)
++		cp210x_change_speed(tty, port, old_termios);
+ 
+ 	/* If the number of data bits is to be updated */
+ 	if ((cflag & CSIZE) != (old_cflag & CSIZE)) {
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index b02fd50..a872cc2 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -796,6 +796,7 @@ static struct usb_device_id id_table_combined [] = {
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++	{ USB_DEVICE(HORNBY_VID, HORNBY_ELITE_PID) },
+ 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ 	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+@@ -804,6 +805,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++	{ USB_DEVICE(FTDI_VID, TI_XDS100V2_PID),
++		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+ 	{ USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
+ 	{ USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
+@@ -840,6 +843,7 @@ static struct usb_device_id id_table_combined [] = {
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
++	{ USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+@@ -1326,8 +1330,7 @@ static int set_serial_info(struct tty_struct *tty,
+ 		goto check_and_exit;
+ 	}
+ 
+-	if ((new_serial.baud_base != priv->baud_base) &&
+-	    (new_serial.baud_base < 9600)) {
++	if (new_serial.baud_base != priv->baud_base) {
+ 		mutex_unlock(&priv->cfg_lock);
+ 		return -EINVAL;
+ 	}
+@@ -1816,6 +1819,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
+ 
+ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
++	struct ktermios dummy;
+ 	struct usb_device *dev = port->serial->dev;
+ 	struct ftdi_private *priv = usb_get_serial_port_data(port);
+ 	int result;
+@@ -1834,8 +1838,10 @@ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	   This is same behaviour as serial.c/rs_open() - Kuba */
+ 
+ 	/* ftdi_set_termios  will send usb control messages */
+-	if (tty)
+-		ftdi_set_termios(tty, port, tty->termios);
++	if (tty) {
++		memset(&dummy, 0, sizeof(dummy));
++		ftdi_set_termios(tty, port, &dummy);
++	}
+ 
+ 	/* Start reading from the device */
+ 	result = usb_serial_generic_open(tty, port);
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 055b64e..76d4f31 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -39,6 +39,13 @@
+ /* www.candapter.com Ewert Energy Systems CANdapter device */
+ #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+ 
++/*
++ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
++ * http://processors.wiki.ti.com/index.php/XDS100
++ * http://beagleboard.org/bone
++ */
++#define TI_XDS100V2_PID		0xa6d0
++
+ #define FTDI_NXTCAM_PID		0xABB8 /* NXTCam for Mindstorms NXT */
+ 
+ /* US Interface Navigator (http://www.usinterface.com/) */
+@@ -525,6 +532,12 @@
+ #define ADI_GNICEPLUS_PID	0xF001
+ 
+ /*
++ * Hornby Elite
++ */
++#define HORNBY_VID		0x04D8
++#define HORNBY_ELITE_PID	0x000A
++
++/*
+  * RATOC REX-USB60F
+  */
+ #define RATOC_VENDOR_ID		0x0584
+@@ -1168,3 +1181,9 @@
+  */
+ /* TagTracer MIFARE*/
+ #define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID	0xF7C0
++
++/*
++ * Rainforest Automation
++ */
++/* ZigBee controller */
++#define FTDI_RF_R106		0x8A28
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 0aac00a..8a90d58 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -2677,15 +2677,7 @@ cleanup:
+ 
+ static void edge_disconnect(struct usb_serial *serial)
+ {
+-	int i;
+-	struct edgeport_port *edge_port;
+-
+ 	dbg("%s", __func__);
+-
+-	for (i = 0; i < serial->num_ports; ++i) {
+-		edge_port = usb_get_serial_port_data(serial->port[i]);
+-		edge_remove_sysfs_attrs(edge_port->port);
+-	}
+ }
+ 
+ static void edge_release(struct usb_serial *serial)
+@@ -2764,6 +2756,7 @@ static struct usb_serial_driver edgeport_1port_device = {
+ 	.disconnect		= edge_disconnect,
+ 	.release		= edge_release,
+ 	.port_probe		= edge_create_sysfs_attrs,
++	.port_remove		= edge_remove_sysfs_attrs,
+ 	.ioctl			= edge_ioctl,
+ 	.set_termios		= edge_set_termios,
+ 	.tiocmget		= edge_tiocmget,
+@@ -2795,6 +2788,7 @@ static struct usb_serial_driver edgeport_2port_device = {
+ 	.disconnect		= edge_disconnect,
+ 	.release		= edge_release,
+ 	.port_probe		= edge_create_sysfs_attrs,
++	.port_remove		= edge_remove_sysfs_attrs,
+ 	.ioctl			= edge_ioctl,
+ 	.set_termios		= edge_set_termios,
+ 	.tiocmget		= edge_tiocmget,
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c96b6b6..2a9ed6e 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -480,6 +480,10 @@ static void option_instat_callback(struct urb *urb);
+ #define ZD_VENDOR_ID				0x0685
+ #define ZD_PRODUCT_7000				0x7000
+ 
++/* LG products */
++#define LG_VENDOR_ID				0x1004
++#define LG_PRODUCT_L02C				0x618f
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ 		OPTION_BLACKLIST_NONE = 0,
+@@ -1183,6 +1187,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
+index 30b73e6..a348198 100644
+--- a/drivers/usb/serial/qcaux.c
++++ b/drivers/usb/serial/qcaux.c
+@@ -36,6 +36,7 @@
+ #define UTSTARCOM_PRODUCT_UM175_V1		0x3712
+ #define UTSTARCOM_PRODUCT_UM175_V2		0x3714
+ #define UTSTARCOM_PRODUCT_UM175_ALLTEL		0x3715
++#define PANTECH_PRODUCT_UML190_VZW		0x3716
+ #define PANTECH_PRODUCT_UML290_VZW		0x3718
+ 
+ /* CMOTECH devices */
+@@ -67,7 +68,11 @@ static struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xfe, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfd, 0xff) },  /* NMEA */
++	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfe, 0xff) },  /* WMC */
++	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },  /* DIAG */
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index 7cf5c3e..c6602d2 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ 			(unsigned long long)(extent_base + extent_offset), rc);
+ 		goto out;
+ 	}
+-	if (unlikely(ecryptfs_verbosity > 0)) {
+-		ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
+-				"with iv:\n");
+-		ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+-		ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+-				"encryption:\n");
+-		ecryptfs_dump_hex((char *)
+-				  (page_address(page)
+-				   + (extent_offset * crypt_stat->extent_size)),
+-				  8);
+-	}
+ 	rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
+ 					  page, (extent_offset
+ 						 * crypt_stat->extent_size),
+@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
+ 		goto out;
+ 	}
+ 	rc = 0;
+-	if (unlikely(ecryptfs_verbosity > 0)) {
+-		ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
+-			"rc = [%d]\n",
+-			(unsigned long long)(extent_base + extent_offset), rc);
+-		ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+-				"encryption:\n");
+-		ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
+-	}
+ out:
+ 	return rc;
+ }
+@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ 			(unsigned long long)(extent_base + extent_offset), rc);
+ 		goto out;
+ 	}
+-	if (unlikely(ecryptfs_verbosity > 0)) {
+-		ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
+-				"with iv:\n");
+-		ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
+-		ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
+-				"decryption:\n");
+-		ecryptfs_dump_hex((char *)
+-				  (page_address(enc_extent_page)
+-				   + (extent_offset * crypt_stat->extent_size)),
+-				  8);
+-	}
+ 	rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
+ 					  (extent_offset
+ 					   * crypt_stat->extent_size),
+@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
+ 		goto out;
+ 	}
+ 	rc = 0;
+-	if (unlikely(ecryptfs_verbosity > 0)) {
+-		ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
+-			"rc = [%d]\n",
+-			(unsigned long long)(extent_base + extent_offset), rc);
+-		ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
+-				"decryption:\n");
+-		ecryptfs_dump_hex((char *)(page_address(page)
+-					   + (extent_offset
+-					      * crypt_stat->extent_size)), 8);
+-	}
+ out:
+ 	return rc;
+ }
+@@ -1618,7 +1578,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ 		rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
+ 		if (rc) {
+ 			printk(KERN_DEBUG "Valid eCryptfs headers not found in "
+-			       "file header region or xattr region\n");
++			       "file header region or xattr region, inode %lu\n",
++				ecryptfs_inode->i_ino);
+ 			rc = -EINVAL;
+ 			goto out;
+ 		}
+@@ -1627,7 +1588,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ 						ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
+ 		if (rc) {
+ 			printk(KERN_DEBUG "Valid eCryptfs headers not found in "
+-			       "file xattr region either\n");
++			       "file xattr region either, inode %lu\n",
++				ecryptfs_inode->i_ino);
+ 			rc = -EINVAL;
+ 		}
+ 		if (crypt_stat->mount_crypt_stat->flags
+@@ -1638,7 +1600,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
+ 			       "crypto metadata only in the extended attribute "
+ 			       "region, but eCryptfs was mounted without "
+ 			       "xattr support enabled. eCryptfs will not treat "
+-			       "this like an encrypted file.\n");
++			       "this like an encrypted file, inode %lu\n",
++				ecryptfs_inode->i_ino);
+ 			rc = -EINVAL;
+ 		}
+ 	}
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 4a4fad7f..e3562f2 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -854,18 +854,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
+ 		size_t num_zeros = (PAGE_CACHE_SIZE
+ 				    - (ia->ia_size & ~PAGE_CACHE_MASK));
+ 
+-
+-		/*
+-		 * XXX(truncate) this should really happen at the begginning
+-		 * of ->setattr.  But the code is too messy to that as part
+-		 * of a larger patch.  ecryptfs is also totally missing out
+-		 * on the inode_change_ok check at the beginning of
+-		 * ->setattr while would include this.
+-		 */
+-		rc = inode_newsize_ok(inode, ia->ia_size);
+-		if (rc)
+-			goto out;
+-
+ 		if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
+ 			truncate_setsize(inode, ia->ia_size);
+ 			lower_ia->ia_size = ia->ia_size;
+@@ -915,6 +903,28 @@ out:
+ 	return rc;
+ }
+ 
++static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
++{
++	struct ecryptfs_crypt_stat *crypt_stat;
++	loff_t lower_oldsize, lower_newsize;
++
++	crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
++	lower_oldsize = upper_size_to_lower_size(crypt_stat,
++						 i_size_read(inode));
++	lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
++	if (lower_newsize > lower_oldsize) {
++		/*
++		 * The eCryptfs inode and the new *lower* size are mixed here
++		 * because we may not have the lower i_mutex held and/or it may
++		 * not be appropriate to call inode_newsize_ok() with inodes
++		 * from other filesystems.
++		 */
++		return inode_newsize_ok(inode, lower_newsize);
++	}
++
++	return 0;
++}
++
+ /**
+  * ecryptfs_truncate
+  * @dentry: The ecryptfs layer dentry
+@@ -931,6 +941,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
+ 	struct iattr lower_ia = { .ia_valid = 0 };
+ 	int rc;
+ 
++	rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
++	if (rc)
++		return rc;
++
+ 	rc = truncate_upper(dentry, &ia, &lower_ia);
+ 	if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
+ 		struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+@@ -1012,6 +1026,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
+ 		}
+ 	}
+ 	mutex_unlock(&crypt_stat->cs_mutex);
++
++	rc = inode_change_ok(inode, ia);
++	if (rc)
++		goto out;
++	if (ia->ia_valid & ATTR_SIZE) {
++		rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
++		if (rc)
++			goto out;
++	}
++
+ 	if (S_ISREG(inode->i_mode)) {
+ 		rc = filemap_write_and_wait(inode->i_mapping);
+ 		if (rc)
+diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
+index 940a82e..0dc5a3d 100644
+--- a/fs/ecryptfs/miscdev.c
++++ b/fs/ecryptfs/miscdev.c
+@@ -409,11 +409,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
+ 	ssize_t sz = 0;
+ 	char *data;
+ 	uid_t euid = current_euid();
++	unsigned char packet_size_peek[3];
+ 	int rc;
+ 
+-	if (count == 0)
++	if (count == 0) {
+ 		goto out;
++	} else if (count == (1 + 4)) {
++		/* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
++		goto memdup;
++	} else if (count < (1 + 4 + 1)
++		   || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
++			       + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
++		printk(KERN_WARNING "%s: Acceptable packet size range is "
++		       "[%d-%lu], but amount of data written is [%zu].",
++		       __func__, (1 + 4 + 1),
++		       (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
++			+ ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
++		return -EINVAL;
++	}
++
++	if (copy_from_user(packet_size_peek, (buf + 1 + 4),
++			   sizeof(packet_size_peek))) {
++		printk(KERN_WARNING "%s: Error while inspecting packet size\n",
++		       __func__);
++		return -EFAULT;
++	}
++
++	rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
++					  &packet_size_length);
++	if (rc) {
++		printk(KERN_WARNING "%s: Error parsing packet length; "
++		       "rc = [%d]\n", __func__, rc);
++		return rc;
++	}
++
++	if ((1 + 4 + packet_size_length + packet_size) != count) {
++		printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
++		       packet_size);
++		return -EINVAL;
++	}
+ 
++memdup:
+ 	data = memdup_user(buf, count);
+ 	if (IS_ERR(data)) {
+ 		printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
+@@ -435,23 +471,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
+ 		}
+ 		memcpy(&counter_nbo, &data[i], 4);
+ 		seq = be32_to_cpu(counter_nbo);
+-		i += 4;
+-		rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
+-						  &packet_size_length);
+-		if (rc) {
+-			printk(KERN_WARNING "%s: Error parsing packet length; "
+-			       "rc = [%d]\n", __func__, rc);
+-			goto out_free;
+-		}
+-		i += packet_size_length;
+-		if ((1 + 4 + packet_size_length + packet_size) != count) {
+-			printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
+-			       " + packet_size([%zd]))([%zd]) != "
+-			       "count([%zd]). Invalid packet format.\n",
+-			       __func__, packet_size_length, packet_size,
+-			       (1 + packet_size_length + packet_size), count);
+-			goto out_free;
+-		}
++		i += 4 + packet_size_length;
+ 		rc = ecryptfs_miscdev_response(&data[i], packet_size,
+ 					       euid, current_user_ns(),
+ 					       task_pid(current), seq);
+diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
+index 3745f7c..54eb14c 100644
+--- a/fs/ecryptfs/read_write.c
++++ b/fs/ecryptfs/read_write.c
+@@ -132,6 +132,11 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ 		size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
+ 		size_t total_remaining_bytes = ((offset + size) - pos);
+ 
++		if (fatal_signal_pending(current)) {
++			rc = -EINTR;
++			break;
++		}
++
+ 		if (num_bytes > total_remaining_bytes)
+ 			num_bytes = total_remaining_bytes;
+ 		if (pos < offset) {
+@@ -193,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
+ 		}
+ 		pos += num_bytes;
+ 	}
+-	if ((offset + size) > ecryptfs_file_size) {
+-		i_size_write(ecryptfs_inode, (offset + size));
++	if (pos > ecryptfs_file_size) {
++		i_size_write(ecryptfs_inode, pos);
+ 		if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
+-			rc = ecryptfs_write_inode_size_to_metadata(
++			int rc2;
++
++			rc2 = ecryptfs_write_inode_size_to_metadata(
+ 								ecryptfs_inode);
+-			if (rc) {
++			if (rc2) {
+ 				printk(KERN_ERR	"Problem with "
+ 				       "ecryptfs_write_inode_size_to_metadata; "
+-				       "rc = [%d]\n", rc);
++				       "rc = [%d]\n", rc2);
++				if (!rc)
++					rc = rc2;
+ 				goto out;
+ 			}
+ 		}
+diff --git a/fs/xfs/linux-2.6/xfs_discard.c b/fs/xfs/linux-2.6/xfs_discard.c
+index 244e797..572494f 100644
+--- a/fs/xfs/linux-2.6/xfs_discard.c
++++ b/fs/xfs/linux-2.6/xfs_discard.c
+@@ -68,7 +68,7 @@ xfs_trim_extents(
+ 	 * Look up the longest btree in the AGF and start with it.
+ 	 */
+ 	error = xfs_alloc_lookup_le(cur, 0,
+-				    XFS_BUF_TO_AGF(agbp)->agf_longest, &i);
++			    be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest), &i);
+ 	if (error)
+ 		goto out_del_cursor;
+ 
+@@ -84,7 +84,7 @@ xfs_trim_extents(
+ 		if (error)
+ 			goto out_del_cursor;
+ 		XFS_WANT_CORRUPTED_GOTO(i == 1, out_del_cursor);
+-		ASSERT(flen <= XFS_BUF_TO_AGF(agbp)->agf_longest);
++		ASSERT(flen <= be32_to_cpu(XFS_BUF_TO_AGF(agbp)->agf_longest));
+ 
+ 		/*
+ 		 * Too small?  Give up.
+diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
+index 6cc4d41..59509ae 100644
+--- a/fs/xfs/xfs_vnodeops.c
++++ b/fs/xfs/xfs_vnodeops.c
+@@ -554,7 +554,8 @@ xfs_readlink(
+ 			 __func__, (unsigned long long) ip->i_ino,
+ 			 (long long) pathlen);
+ 		ASSERT(0);
+-		return XFS_ERROR(EFSCORRUPTED);
++		error = XFS_ERROR(EFSCORRUPTED);
++		goto out;
+ 	}
+ 
+ 
+diff --git a/include/drm/drmP.h b/include/drm/drmP.h
+index 738b3a5..40aaebf 100644
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -1323,6 +1323,7 @@ extern int drm_getmagic(struct drm_device *dev, void *data,
+ 			struct drm_file *file_priv);
+ extern int drm_authmagic(struct drm_device *dev, void *data,
+ 			 struct drm_file *file_priv);
++extern int drm_remove_magic(struct drm_master *master, drm_magic_t magic);
+ 
+ /* Cache management (drm_cache.c) */
+ void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
+diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
+index 3419bf5..d55f434 100644
+--- a/include/net/netns/generic.h
++++ b/include/net/netns/generic.h
+@@ -41,6 +41,7 @@ static inline void *net_generic(const struct net *net, int id)
+ 	ptr = ng->ptr[id - 1];
+ 	rcu_read_unlock();
+ 
++	BUG_ON(!ptr);
+ 	return ptr;
+ }
+ #endif
+diff --git a/kernel/printk.c b/kernel/printk.c
+index 084982f..3fc4708 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -318,8 +318,10 @@ static int check_syslog_permissions(int type, bool from_file)
+ 			return 0;
+ 		/* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
+ 		if (capable(CAP_SYS_ADMIN)) {
+-			WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
+-				 "but no CAP_SYSLOG (deprecated).\n");
++			printk_once(KERN_WARNING "%s (%d): "
++				 "Attempt to access syslog with CAP_SYS_ADMIN "
++				 "but no CAP_SYSLOG (deprecated).\n",
++				 current->comm, task_pid_nr(current));
+ 			return 0;
+ 		}
+ 		return -EPERM;
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index ef9271b..9f8e2e1 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -952,7 +952,7 @@ struct ftrace_func_probe {
+ };
+ 
+ enum {
+-	FTRACE_ENABLE_CALLS		= (1 << 0),
++	FTRACE_UPDATE_CALLS		= (1 << 0),
+ 	FTRACE_DISABLE_CALLS		= (1 << 1),
+ 	FTRACE_UPDATE_TRACE_FUNC	= (1 << 2),
+ 	FTRACE_START_FUNC_RET		= (1 << 3),
+@@ -1182,8 +1182,14 @@ alloc_and_copy_ftrace_hash(int size_bits, struct ftrace_hash *hash)
+ 	return NULL;
+ }
+ 
++static void
++ftrace_hash_rec_disable(struct ftrace_ops *ops, int filter_hash);
++static void
++ftrace_hash_rec_enable(struct ftrace_ops *ops, int filter_hash);
++
+ static int
+-ftrace_hash_move(struct ftrace_hash **dst, struct ftrace_hash *src)
++ftrace_hash_move(struct ftrace_ops *ops, int enable,
++		 struct ftrace_hash **dst, struct ftrace_hash *src)
+ {
+ 	struct ftrace_func_entry *entry;
+ 	struct hlist_node *tp, *tn;
+@@ -1193,9 +1199,16 @@ ftrace_hash_move(struct ftrace_hash **dst, struct ftrace_hash *src)
+ 	unsigned long key;
+ 	int size = src->count;
+ 	int bits = 0;
++	int ret;
+ 	int i;
+ 
+ 	/*
++	 * Remove the current set, update the hash and add
++	 * them back.
++	 */
++	ftrace_hash_rec_disable(ops, enable);
++
++	/*
+ 	 * If the new source is empty, just free dst and assign it
+ 	 * the empty_hash.
+ 	 */
+@@ -1215,9 +1228,10 @@ ftrace_hash_move(struct ftrace_hash **dst, struct ftrace_hash *src)
+ 	if (bits > FTRACE_HASH_MAX_BITS)
+ 		bits = FTRACE_HASH_MAX_BITS;
+ 
++	ret = -ENOMEM;
+ 	new_hash = alloc_ftrace_hash(bits);
+ 	if (!new_hash)
+-		return -ENOMEM;
++		goto out;
+ 
+ 	size = 1 << src->size_bits;
+ 	for (i = 0; i < size; i++) {
+@@ -1236,7 +1250,16 @@ ftrace_hash_move(struct ftrace_hash **dst, struct ftrace_hash *src)
+ 	rcu_assign_pointer(*dst, new_hash);
+ 	free_ftrace_hash_rcu(old_hash);
+ 
+-	return 0;
++	ret = 0;
++ out:
++	/*
++	 * Enable regardless of ret:
++	 *  On success, we enable the new hash.
++	 *  On failure, we re-enable the original hash.
++	 */
++	ftrace_hash_rec_enable(ops, enable);
++
++	return ret;
+ }
+ 
+ /*
+@@ -1498,7 +1521,7 @@ int ftrace_text_reserved(void *start, void *end)
+ 
+ 
+ static int
+-__ftrace_replace_code(struct dyn_ftrace *rec, int enable)
++__ftrace_replace_code(struct dyn_ftrace *rec, int update)
+ {
+ 	unsigned long ftrace_addr;
+ 	unsigned long flag = 0UL;
+@@ -1506,17 +1529,17 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ 	ftrace_addr = (unsigned long)FTRACE_ADDR;
+ 
+ 	/*
+-	 * If we are enabling tracing:
++	 * If we are updating calls:
+ 	 *
+ 	 *   If the record has a ref count, then we need to enable it
+ 	 *   because someone is using it.
+ 	 *
+ 	 *   Otherwise we make sure its disabled.
+ 	 *
+-	 * If we are disabling tracing, then disable all records that
++	 * If we are disabling calls, then disable all records that
+ 	 * are enabled.
+ 	 */
+-	if (enable && (rec->flags & ~FTRACE_FL_MASK))
++	if (update && (rec->flags & ~FTRACE_FL_MASK))
+ 		flag = FTRACE_FL_ENABLED;
+ 
+ 	/* If the state of this record hasn't changed, then do nothing */
+@@ -1532,7 +1555,7 @@ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ 	return ftrace_make_nop(NULL, rec, ftrace_addr);
+ }
+ 
+-static void ftrace_replace_code(int enable)
++static void ftrace_replace_code(int update)
+ {
+ 	struct dyn_ftrace *rec;
+ 	struct ftrace_page *pg;
+@@ -1546,7 +1569,7 @@ static void ftrace_replace_code(int enable)
+ 		if (rec->flags & FTRACE_FL_FREE)
+ 			continue;
+ 
+-		failed = __ftrace_replace_code(rec, enable);
++		failed = __ftrace_replace_code(rec, update);
+ 		if (failed) {
+ 			ftrace_bug(failed, rec->ip);
+ 			/* Stop processing */
+@@ -1596,7 +1619,7 @@ static int __ftrace_modify_code(void *data)
+ {
+ 	int *command = data;
+ 
+-	if (*command & FTRACE_ENABLE_CALLS)
++	if (*command & FTRACE_UPDATE_CALLS)
+ 		ftrace_replace_code(1);
+ 	else if (*command & FTRACE_DISABLE_CALLS)
+ 		ftrace_replace_code(0);
+@@ -1652,7 +1675,7 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
+ 		return -ENODEV;
+ 
+ 	ftrace_start_up++;
+-	command |= FTRACE_ENABLE_CALLS;
++	command |= FTRACE_UPDATE_CALLS;
+ 
+ 	/* ops marked global share the filter hashes */
+ 	if (ops->flags & FTRACE_OPS_FL_GLOBAL) {
+@@ -1704,8 +1727,7 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
+ 	if (ops != &global_ops || !global_start_up)
+ 		ops->flags &= ~FTRACE_OPS_FL_ENABLED;
+ 
+-	if (!ftrace_start_up)
+-		command |= FTRACE_DISABLE_CALLS;
++	command |= FTRACE_UPDATE_CALLS;
+ 
+ 	if (saved_ftrace_func != ftrace_trace_function) {
+ 		saved_ftrace_func = ftrace_trace_function;
+@@ -1727,7 +1749,7 @@ static void ftrace_startup_sysctl(void)
+ 	saved_ftrace_func = NULL;
+ 	/* ftrace_start_up is true if we want ftrace running */
+ 	if (ftrace_start_up)
+-		ftrace_run_update_code(FTRACE_ENABLE_CALLS);
++		ftrace_run_update_code(FTRACE_UPDATE_CALLS);
+ }
+ 
+ static void ftrace_shutdown_sysctl(void)
+@@ -2877,7 +2899,11 @@ ftrace_set_regex(struct ftrace_ops *ops, unsigned char *buf, int len,
+ 		ftrace_match_records(hash, buf, len);
+ 
+ 	mutex_lock(&ftrace_lock);
+-	ret = ftrace_hash_move(orig_hash, hash);
++	ret = ftrace_hash_move(ops, enable, orig_hash, hash);
++	if (!ret && ops->flags & FTRACE_OPS_FL_ENABLED
++	    && ftrace_enabled)
++		ftrace_run_update_code(FTRACE_UPDATE_CALLS);
++
+ 	mutex_unlock(&ftrace_lock);
+ 
+ 	mutex_unlock(&ftrace_regex_lock);
+@@ -3060,18 +3086,12 @@ ftrace_regex_release(struct inode *inode, struct file *file)
+ 			orig_hash = &iter->ops->notrace_hash;
+ 
+ 		mutex_lock(&ftrace_lock);
+-		/*
+-		 * Remove the current set, update the hash and add
+-		 * them back.
+-		 */
+-		ftrace_hash_rec_disable(iter->ops, filter_hash);
+-		ret = ftrace_hash_move(orig_hash, iter->hash);
+-		if (!ret) {
+-			ftrace_hash_rec_enable(iter->ops, filter_hash);
+-			if (iter->ops->flags & FTRACE_OPS_FL_ENABLED
+-			    && ftrace_enabled)
+-				ftrace_run_update_code(FTRACE_ENABLE_CALLS);
+-		}
++		ret = ftrace_hash_move(iter->ops, filter_hash,
++				       orig_hash, iter->hash);
++		if (!ret && (iter->ops->flags & FTRACE_OPS_FL_ENABLED)
++		    && ftrace_enabled)
++			ftrace_run_update_code(FTRACE_UPDATE_CALLS);
++
+ 		mutex_unlock(&ftrace_lock);
+ 	}
+ 	free_ftrace_hash(iter->hash);
+diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
+index dbdaa95..5ba4366 100644
+--- a/net/caif/caif_dev.c
++++ b/net/caif/caif_dev.c
+@@ -53,7 +53,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
+ 	struct caif_net *caifn;
+ 	BUG_ON(!net);
+ 	caifn = net_generic(net, caif_net_id);
+-	BUG_ON(!caifn);
+ 	return caifn->cfg;
+ }
+ EXPORT_SYMBOL(get_cfcnfg);
+@@ -63,7 +62,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
+ 	struct caif_net *caifn;
+ 	BUG_ON(!net);
+ 	caifn = net_generic(net, caif_net_id);
+-	BUG_ON(!caifn);
+ 	return &caifn->caifdevs;
+ }
+ 
+@@ -92,7 +90,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
+ 	struct caif_device_entry *caifd;
+ 
+ 	caifdevs = caif_device_list(dev_net(dev));
+-	BUG_ON(!caifdevs);
+ 
+ 	caifd = kzalloc(sizeof(*caifd), GFP_ATOMIC);
+ 	if (!caifd)
+@@ -108,7 +105,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
+ 	struct caif_device_entry_list *caifdevs =
+ 	    caif_device_list(dev_net(dev));
+ 	struct caif_device_entry *caifd;
+-	BUG_ON(!caifdevs);
++
+ 	list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
+ 		if (caifd->netdev == dev)
+ 			return caifd;
+@@ -349,7 +346,7 @@ static struct notifier_block caif_device_notifier = {
+ static int caif_init_net(struct net *net)
+ {
+ 	struct caif_net *caifn = net_generic(net, caif_net_id);
+-	BUG_ON(!caifn);
++
+ 	INIT_LIST_HEAD(&caifn->caifdevs.list);
+ 	mutex_init(&caifn->caifdevs.lock);
+ 
+@@ -414,7 +411,7 @@ static int __init caif_device_init(void)
+ {
+ 	int result;
+ 
+-	result = register_pernet_device(&caif_net_ops);
++	result = register_pernet_subsys(&caif_net_ops);
+ 
+ 	if (result)
+ 		return result;
+@@ -427,7 +424,7 @@ static int __init caif_device_init(void)
+ 
+ static void __exit caif_device_exit(void)
+ {
+-	unregister_pernet_device(&caif_net_ops);
++	unregister_pernet_subsys(&caif_net_ops);
+ 	unregister_netdevice_notifier(&caif_device_notifier);
+ 	dev_remove_pack(&caif_packet_type);
+ }
+diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
+index 52fe33b..bca32d7 100644
+--- a/net/caif/cfcnfg.c
++++ b/net/caif/cfcnfg.c
+@@ -313,7 +313,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
+ 	int err;
+ 	struct cfctrl_link_param param;
+ 	struct cfcnfg *cfg = get_cfcnfg(net);
+-	caif_assert(cfg != NULL);
+ 
+ 	rcu_read_lock();
+ 	err = caif_connect_req_to_link_param(cfg, conn_req, &param);
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index ea489db..0b0211d 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -29,6 +29,20 @@ EXPORT_SYMBOL(init_net);
+ 
+ #define INITIAL_NET_GEN_PTRS	13 /* +1 for len +2 for rcu_head */
+ 
++static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
++
++static struct net_generic *net_alloc_generic(void)
++{
++	struct net_generic *ng;
++	size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
++
++	ng = kzalloc(generic_size, GFP_KERNEL);
++	if (ng)
++		ng->len = max_gen_ptrs;
++
++	return ng;
++}
++
+ static int net_assign_generic(struct net *net, int id, void *data)
+ {
+ 	struct net_generic *ng, *old_ng;
+@@ -42,8 +56,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
+ 	if (old_ng->len >= id)
+ 		goto assign;
+ 
+-	ng = kzalloc(sizeof(struct net_generic) +
+-			id * sizeof(void *), GFP_KERNEL);
++	ng = net_alloc_generic();
+ 	if (ng == NULL)
+ 		return -ENOMEM;
+ 
+@@ -58,7 +71,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
+ 	 * the old copy for kfree after a grace period.
+ 	 */
+ 
+-	ng->len = id;
+ 	memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
+ 
+ 	rcu_assign_pointer(net->gen, ng);
+@@ -159,18 +171,6 @@ out_undo:
+ 	goto out;
+ }
+ 
+-static struct net_generic *net_alloc_generic(void)
+-{
+-	struct net_generic *ng;
+-	size_t generic_size = sizeof(struct net_generic) +
+-		INITIAL_NET_GEN_PTRS * sizeof(void *);
+-
+-	ng = kzalloc(generic_size, GFP_KERNEL);
+-	if (ng)
+-		ng->len = INITIAL_NET_GEN_PTRS;
+-
+-	return ng;
+-}
+ 
+ #ifdef CONFIG_NET_NS
+ static struct kmem_cache *net_cachep;
+@@ -481,6 +481,7 @@ again:
+ 			}
+ 			return error;
+ 		}
++		max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
+ 	}
+ 	error = __register_pernet_operations(list, ops);
+ 	if (error) {
+diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
+index c7056b2..36d1440 100644
+--- a/net/ipv4/ah4.c
++++ b/net/ipv4/ah4.c
+@@ -369,8 +369,6 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
+ 		if (err == -EINPROGRESS)
+ 			goto out;
+ 
+-		if (err == -EBUSY)
+-			err = NET_XMIT_DROP;
+ 		goto out_free;
+ 	}
+ 
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 69790aa..53b0125 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -630,7 +630,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
+ 	arg.iov[0].iov_len  = sizeof(rep.th);
+ 
+ #ifdef CONFIG_TCP_MD5SIG
+-	key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
++	key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
+ 	if (key) {
+ 		rep.opt[0] = htonl((TCPOPT_NOP << 24) |
+ 				   (TCPOPT_NOP << 16) |
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 882e0b0..faf257b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1134,11 +1134,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
+ 	sk_mem_uncharge(sk, len);
+ 	sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+ 
+-	/* Any change of skb->len requires recalculation of tso
+-	 * factor and mss.
+-	 */
++	/* Any change of skb->len requires recalculation of tso factor. */
+ 	if (tcp_skb_pcount(skb) > 1)
+-		tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
++		tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
+ 
+ 	return 0;
+ }
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 7a33aaa..4c0f894 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -581,8 +581,6 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
+ 		if (err == -EINPROGRESS)
+ 			goto out;
+ 
+-		if (err == -EBUSY)
+-			err = NET_XMIT_DROP;
+ 		goto out_free;
+ 	}
+ 
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 296510a..51587a0 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1096,7 +1096,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
+ 
+ #ifdef CONFIG_TCP_MD5SIG
+ 	if (sk)
+-		key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
++		key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
+ #endif
+ 
+ 	if (th->ack)
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index b6466e7..858ca23 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ 	int rc;
+ 
+-	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
+-		goto drop;
+-
+-	nf_reset(skb);
+-
+ 	/* Charge it to the socket, dropping if the queue is full. */
+ 	rc = sock_queue_rcv_skb(sk, skb);
+ 	if (rc < 0)
+diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
+index bb6ad81..424ff62 100644
+--- a/net/rds/af_rds.c
++++ b/net/rds/af_rds.c
+@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
+ {
+ 	struct sock *sk = sock->sk;
+ 	struct rds_sock *rs;
+-	unsigned long flags;
+ 
+ 	if (!sk)
+ 		goto out;
+@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
+ 	rds_rdma_drop_keys(rs);
+ 	rds_notify_queue_get(rs, NULL);
+ 
+-	spin_lock_irqsave(&rds_sock_lock, flags);
++	spin_lock_bh(&rds_sock_lock);
+ 	list_del_init(&rs->rs_item);
+ 	rds_sock_count--;
+-	spin_unlock_irqrestore(&rds_sock_lock, flags);
++	spin_unlock_bh(&rds_sock_lock);
+ 
+ 	rds_trans_put(rs->rs_transport);
+ 
+@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
+ 
+ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
+ {
+-	unsigned long flags;
+ 	struct rds_sock *rs;
+ 
+ 	sock_init_data(sock, sk);
+@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
+ 	spin_lock_init(&rs->rs_rdma_lock);
+ 	rs->rs_rdma_keys = RB_ROOT;
+ 
+-	spin_lock_irqsave(&rds_sock_lock, flags);
++	spin_lock_bh(&rds_sock_lock);
+ 	list_add_tail(&rs->rs_item, &rds_sock_list);
+ 	rds_sock_count++;
+-	spin_unlock_irqrestore(&rds_sock_lock, flags);
++	spin_unlock_bh(&rds_sock_lock);
+ 
+ 	return 0;
+ }
+@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
+ {
+ 	struct rds_sock *rs;
+ 	struct rds_incoming *inc;
+-	unsigned long flags;
+ 	unsigned int total = 0;
+ 
+ 	len /= sizeof(struct rds_info_message);
+ 
+-	spin_lock_irqsave(&rds_sock_lock, flags);
++	spin_lock_bh(&rds_sock_lock);
+ 
+ 	list_for_each_entry(rs, &rds_sock_list, rs_item) {
+ 		read_lock(&rs->rs_recv_lock);
+@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
+ 		read_unlock(&rs->rs_recv_lock);
+ 	}
+ 
+-	spin_unlock_irqrestore(&rds_sock_lock, flags);
++	spin_unlock_bh(&rds_sock_lock);
+ 
+ 	lens->nr = total;
+ 	lens->each = sizeof(struct rds_info_message);
+@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
+ {
+ 	struct rds_info_socket sinfo;
+ 	struct rds_sock *rs;
+-	unsigned long flags;
+ 
+ 	len /= sizeof(struct rds_info_socket);
+ 
+-	spin_lock_irqsave(&rds_sock_lock, flags);
++	spin_lock_bh(&rds_sock_lock);
+ 
+ 	if (len < rds_sock_count)
+ 		goto out;
+@@ -529,7 +525,7 @@ out:
+ 	lens->nr = rds_sock_count;
+ 	lens->each = sizeof(struct rds_info_socket);
+ 
+-	spin_unlock_irqrestore(&rds_sock_lock, flags);
++	spin_unlock_bh(&rds_sock_lock);
+ }
+ 
+ static void rds_exit(void)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index eb0a141..51412e1 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -16419,6 +16419,7 @@ static const struct alc_config_preset alc861_presets[] = {
+ /* Pin config fixes */
+ enum {
+ 	PINFIX_FSC_AMILO_PI1505,
++	PINFIX_ASUS_A6RP,
+ };
+ 
+ static const struct alc_fixup alc861_fixups[] = {
+@@ -16430,9 +16431,19 @@ static const struct alc_fixup alc861_fixups[] = {
+ 			{ }
+ 		}
+ 	},
++	[PINFIX_ASUS_A6RP] = {
++		.type = ALC_FIXUP_VERBS,
++		.v.verbs = (const struct hda_verb[]) {
++			/* node 0x0f VREF seems controlling the master output */
++			{ 0x0f, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF50 },
++			{ }
++		},
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc861_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
++	SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", PINFIX_ASUS_A6RP),
+ 	SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
+ 	{}
+ };
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 0d8db75..43d88c7 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4162,13 +4162,15 @@ static int enable_pin_detect(struct hda_codec *codec, hda_nid_t nid,
+ 	return 1;
+ }
+ 
+-static int is_nid_hp_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
++static int is_nid_out_jack_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
+ {
+ 	int i;
+ 	for (i = 0; i < cfg->hp_outs; i++)
+ 		if (cfg->hp_pins[i] == nid)
+ 			return 1; /* nid is a HP-Out */
+-
++	for (i = 0; i < cfg->line_outs; i++)
++		if (cfg->line_out_pins[i] == nid)
++			return 1; /* nid is a line-Out */
+ 	return 0; /* nid is not a HP-Out */
+ };
+ 
+@@ -4354,7 +4356,7 @@ static int stac92xx_init(struct hda_codec *codec)
+ 			continue;
+ 		}
+ 
+-		if (is_nid_hp_pin(cfg, nid))
++		if (is_nid_out_jack_pin(cfg, nid))
+ 			continue; /* already has an unsol event */
+ 
+ 		pinctl = snd_hda_codec_read(codec, nid, 0,

Added: genpatches-2.6/trunk/3.0/1019_linux-3.0.20.patch
===================================================================
--- genpatches-2.6/trunk/3.0/1019_linux-3.0.20.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.0/1019_linux-3.0.20.patch	2012-02-07 14:13:03 UTC (rev 2084)
@@ -0,0 +1,205 @@
+diff --git a/Makefile b/Makefile
+index 1e57901..c060c58 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 0
+-SUBLEVEL = 19
++SUBLEVEL = 20
+ EXTRAVERSION =
+ NAME = Sneaky Weasel
+ 
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index d06078d..dfafecb 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -595,6 +595,13 @@ static int __devinit acpi_pci_root_add(struct acpi_device *device)
+ 		if (ACPI_SUCCESS(status)) {
+ 			dev_info(root->bus->bridge,
+ 				"ACPI _OSC control (0x%02x) granted\n", flags);
++			if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
++				/*
++				 * We have ASPM control, but the FADT indicates
++				 * that it's unsupported. Clear it.
++				 */
++				pcie_clear_aspm(root->bus);
++			}
+ 		} else {
+ 			dev_info(root->bus->bridge,
+ 				"ACPI _OSC request failed (%s), "
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index d36f41e..56b04bc 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -393,7 +393,6 @@ static int __init acpi_pci_init(void)
+ 
+ 	if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
+ 		printk(KERN_INFO"ACPI FADT declares the system doesn't support PCIe ASPM, so disable it\n");
+-		pcie_clear_aspm();
+ 		pcie_no_aspm();
+ 	}
+ 
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 6892601..e25af67 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -68,7 +68,7 @@ struct pcie_link_state {
+ 	struct aspm_latency acceptable[8];
+ };
+ 
+-static int aspm_disabled, aspm_force, aspm_clear_state;
++static int aspm_disabled, aspm_force;
+ static bool aspm_support_enabled = true;
+ static DEFINE_MUTEX(aspm_lock);
+ static LIST_HEAD(link_list);
+@@ -500,9 +500,6 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
+ 	int pos;
+ 	u32 reg32;
+ 
+-	if (aspm_clear_state)
+-		return -EINVAL;
+-
+ 	/*
+ 	 * Some functions in a slot might not all be PCIe functions,
+ 	 * very strange. Disable ASPM for the whole slot
+@@ -574,9 +571,6 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ 	    pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ 		return;
+ 
+-	if (aspm_disabled && !aspm_clear_state)
+-		return;
+-
+ 	/* VIA has a strange chipset, root port is under a bridge */
+ 	if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
+ 	    pdev->bus->self)
+@@ -608,7 +602,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ 	 * the BIOS's expectation, we'll do so once pci_enable_device() is
+ 	 * called.
+ 	 */
+-	if (aspm_policy != POLICY_POWERSAVE || aspm_clear_state) {
++	if (aspm_policy != POLICY_POWERSAVE) {
+ 		pcie_config_aspm_path(link);
+ 		pcie_set_clkpm(link, policy_to_clkpm_state(link));
+ 	}
+@@ -649,8 +643,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ 	struct pci_dev *parent = pdev->bus->self;
+ 	struct pcie_link_state *link, *root, *parent_link;
+ 
+-	if ((aspm_disabled && !aspm_clear_state) || !pci_is_pcie(pdev) ||
+-	    !parent || !parent->link_state)
++	if (!pci_is_pcie(pdev) || !parent || !parent->link_state)
+ 		return;
+ 	if ((parent->pcie_type != PCI_EXP_TYPE_ROOT_PORT) &&
+ 	    (parent->pcie_type != PCI_EXP_TYPE_DOWNSTREAM))
+@@ -734,13 +727,18 @@ void pcie_aspm_powersave_config_link(struct pci_dev *pdev)
+  * pci_disable_link_state - disable pci device's link state, so the link will
+  * never enter specific states
+  */
+-static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
++static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem,
++				     bool force)
+ {
+ 	struct pci_dev *parent = pdev->bus->self;
+ 	struct pcie_link_state *link;
+ 
+-	if (aspm_disabled || !pci_is_pcie(pdev))
++	if (aspm_disabled && !force)
++		return;
++
++	if (!pci_is_pcie(pdev))
+ 		return;
++
+ 	if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT ||
+ 	    pdev->pcie_type == PCI_EXP_TYPE_DOWNSTREAM)
+ 		parent = pdev;
+@@ -768,16 +766,31 @@ static void __pci_disable_link_state(struct pci_dev *pdev, int state, bool sem)
+ 
+ void pci_disable_link_state_locked(struct pci_dev *pdev, int state)
+ {
+-	__pci_disable_link_state(pdev, state, false);
++	__pci_disable_link_state(pdev, state, false, false);
+ }
+ EXPORT_SYMBOL(pci_disable_link_state_locked);
+ 
+ void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+-	__pci_disable_link_state(pdev, state, true);
++	__pci_disable_link_state(pdev, state, true, false);
+ }
+ EXPORT_SYMBOL(pci_disable_link_state);
+ 
++void pcie_clear_aspm(struct pci_bus *bus)
++{
++	struct pci_dev *child;
++
++	/*
++	 * Clear any ASPM setup that the firmware has carried out on this bus
++	 */
++	list_for_each_entry(child, &bus->devices, bus_list) {
++		__pci_disable_link_state(child, PCIE_LINK_STATE_L0S |
++					 PCIE_LINK_STATE_L1 |
++					 PCIE_LINK_STATE_CLKPM,
++					 false, true);
++	}
++}
++
+ static int pcie_aspm_set_policy(const char *val, struct kernel_param *kp)
+ {
+ 	int i;
+@@ -935,6 +948,7 @@ void pcie_aspm_remove_sysfs_dev_files(struct pci_dev *pdev)
+ static int __init pcie_aspm_disable(char *str)
+ {
+ 	if (!strcmp(str, "off")) {
++		aspm_policy = POLICY_DEFAULT;
+ 		aspm_disabled = 1;
+ 		aspm_support_enabled = false;
+ 		printk(KERN_INFO "PCIe ASPM is disabled\n");
+@@ -947,16 +961,18 @@ static int __init pcie_aspm_disable(char *str)
+ 
+ __setup("pcie_aspm=", pcie_aspm_disable);
+ 
+-void pcie_clear_aspm(void)
+-{
+-	if (!aspm_force)
+-		aspm_clear_state = 1;
+-}
+-
+ void pcie_no_aspm(void)
+ {
+-	if (!aspm_force)
++	/*
++	 * Disabling ASPM is intended to prevent the kernel from modifying
++	 * existing hardware state, not to clear existing state. To that end:
++	 * (a) set policy to POLICY_DEFAULT in order to avoid changing state
++	 * (b) prevent userspace from changing policy
++	 */
++	if (!aspm_force) {
++		aspm_policy = POLICY_DEFAULT;
+ 		aspm_disabled = 1;
++	}
+ }
+ 
+ /**
+diff --git a/include/linux/pci-aspm.h b/include/linux/pci-aspm.h
+index 7cea7b6..c832014 100644
+--- a/include/linux/pci-aspm.h
++++ b/include/linux/pci-aspm.h
+@@ -29,7 +29,7 @@ extern void pcie_aspm_pm_state_change(struct pci_dev *pdev);
+ extern void pcie_aspm_powersave_config_link(struct pci_dev *pdev);
+ extern void pci_disable_link_state(struct pci_dev *pdev, int state);
+ extern void pci_disable_link_state_locked(struct pci_dev *pdev, int state);
+-extern void pcie_clear_aspm(void);
++extern void pcie_clear_aspm(struct pci_bus *bus);
+ extern void pcie_no_aspm(void);
+ #else
+ static inline void pcie_aspm_init_link_state(struct pci_dev *pdev)
+@@ -47,7 +47,7 @@ static inline void pcie_aspm_powersave_config_link(struct pci_dev *pdev)
+ static inline void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+ }
+-static inline void pcie_clear_aspm(void)
++static inline void pcie_clear_aspm(struct pci_bus *bus)
+ {
+ }
+ static inline void pcie_no_aspm(void)